← Utilities

JWT Decoder

Last updated:

Paste a JWT and see the decoded header, payload, and expiry status instantly — decoding only, the signature is never verified or uploaded.

How it works

  • A JWT is three base64url segments joined by dots: header.payload.signature. This tool decodes the header and payload segments (both are just base64url-encoded JSON) and shows them pretty-printed.
  • If the payload has an exp claim (expiry, in seconds since the Unix epoch per RFC 7519), it’s converted to a readable timestamp and compared against the current time.
  • The signature is never checked. Verifying it would require the issuer’s secret (HMAC algorithms) or public key (RSA/ECDSA algorithms) — this tool never asks for either. A token decoding cleanly only tells you it’s well-formed, not that it’s authentic or hasn’t been tampered with.

Runs entirely in your browser — the token you paste is never uploaded, logged, or stored, and there’s no autosave. Still, a JWT is a credential: avoid pasting production access tokens into any third-party tool, this one included, unless you trust it runs fully client-side.

🔧 Also try: JSON Formatter → 🔤 Also try: Base64 Encoder & Decoder → 🕐 Also try: Unix Timestamp Converter →