What is jwt decoder?
A JSON Web Token carries claims about a user or a session in three parts separated by dots: a header, a payload and a signature. The first two are Base64 text that anyone can read.
This decoder shows them as formatted JSON and turns the issued at and expiry numbers into dates, so you can debug login problems quickly.
How to use the jwt decoder
- Paste the token, with or without the word Bearer.
- Read the header, payload and times.
- Check whether it has expired.
How the jwt decoder works
The token is split at the dots. The first two parts are Base64URL decoded and parsed as JSON. The claims iat, nbf and exp are Unix timestamps in seconds, which are turned into dates and compared with the current time.
Worked example
Common uses of the jwt decoder
- Debugging login and API errors.
- Checking token expiry.
- Reading claims such as user id and roles.
- Teaching how tokens work.
- Reviewing an auth integration.
Tips and common mistakes
Never paste live production tokens into tools you do not trust. This one works locally, but treat tokens as secrets anyway.
A readable payload does not mean the token is valid. Only the server can verify the signature.
Background: what to know before you rely on it
JWTs are popular for stateless authentication because a server can trust the claims without a database lookup, as long as it verifies the signature. The common mistake is thinking the contents are private. They are only encoded, so never put passwords or sensitive personal data in a payload. Another common issue is clock difference between servers, which can make a fresh token look not yet valid or already expired. Short lifetimes and refresh tokens reduce the damage if a token leaks.
Private, free and fast
This tool runs entirely in your browser. What you type or choose is not uploaded to a server and is not saved after you close the page, which keeps it fast and private. It is free to use as often as you like. See more in all developer tools, or browse the full list of tools.
Frequently asked questions
Does this verify the signature?
No. It only decodes. Verification needs the secret or public key.
Is a JWT encrypted?
A standard signed JWT is not encrypted. Anyone with the token can read it.
What does exp mean?
The expiry time in Unix seconds.
Is my token sent to a server?
No.
Related tools
Base64 Encoder and Decoder
Base64 turns text or bytes into a safe string of letters and numbers. Choose encode or decode, paste...
Developer ToolsJSON Formatter and Validator
Paste your JSON and the tool checks that it is valid, then formats it with indentation or compresses it...
Developer ToolsUnix Timestamp Converter
A Unix timestamp counts the seconds since 1 January 1970 UTC. Paste a timestamp to see the date, or...
Developer ToolsHash Generator
A hash is a fixed length fingerprint of your text. Enter text to get its SHA 1, SHA 256, SHA 384 and SHA...
Developer ToolsURL Encoder and Decoder
URL encoding replaces unsafe characters with a percent sign and two hex digits so a link works...
Developer ToolsRegex Tester
Enter a pattern, flags and test text. The tester lists every match with its position and capture groups...
Results are for information and education. For legal, financial, medical or security decisions, check with a qualified professional. Do not paste live secrets into any website.