JWT Decoder
Decode JWT headers and payload claims locally without sending tokens to a server.
Decode and inspect token claims locally. Signature verification is not performed.
What a JWT contains
A JSON Web Token normally has three dot-separated Base64URL segments: a header, a payload, and a signature. The header identifies details such as the signing algorithm. The payload contains claims such as the subject, issuer, audience, roles, and timestamps.
Decoding those first two segments is useful for debugging authentication flows, but it does not prove that the token is trustworthy. Signature verification must use a trusted key and must also enforce the expected issuer, audience, algorithm, and time-based claims.
Reading JWT timestamps
JWT time claims use NumericDate values: seconds since 1970-01-01T00:00:00Z. The inspector converts iat, nbf, and exp values to ISO 8601 timestamps and reports whether the token is expired or not active yet.
Frequently Asked Questions
Does this JWT decoder verify the signature?+
No. It decodes the readable header and payload only. Authenticity still has to be verified with the issuer's trusted key and the expected algorithm, audience, and issuer.
Can I paste a production access token here?+
The tool runs locally and does not upload the token, but JWT payloads are merely encoded rather than encrypted. Treat live credentials as secrets and avoid sharing them.
What do exp, iat, and nbf mean?+
They are JWT NumericDate claims measured in seconds since the Unix epoch: expiration time, issued-at time, and the earliest time at which the token should be accepted.