JWT decoder

Decode JWT headers and payloads locally and inspect claims and expiry times. No token uploads or account required. Decoding does not verify the signature.

Enable JavaScript to use this interactive tool. Paste input, choose options, then copy or download the result, or save it to your notebook.

Details and limits

Decode a three-part JWT header/payload locally and inspect claims/times. Decoding does NOT verify its signature, authenticity, issuer, audience, or validity. No keys are fetched.

Example and common questions

Decode a fictional JWT with a dummy signature

Input

eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJkZW1vIn0.ZGVtbw

Decoded result — not verified

{
  "warning": "Decoded only. Signature and authenticity NOT verified.",
  "header": {
    "alg": "HS256"
  },
  "payload": {
    "sub": "demo"
  },
  "claimTimesUTC": {}
}

Does decoding verify a token?

No. Decoding does not verify the signature, issuer, audience or authenticity. The tool does not fetch keys or establish that a token is valid.

What are iat, nbf and exp?

They are NumericDate claims for issued-at, not-before and expiration times. Numeric claims are displayed as UTC times without declaring the token valid; invalid NumericDate values are labelled as invalid.

Which token format works?

Use a three-part compact JWT with JSON objects in its header and payload. Encrypted five-part tokens are not supported.

Common errors and limitations

Check the three segments, Base64url encoding and JSON object shapes. Invalid NumericDate claims are marked in the decoded output. A successful decode still does not verify the signature.