JWT Decoder

What is a JWT?

A JSON Web Token (JWT) is a compact, URL-safe way to carry a set of claims between two parties. It is three base64url-encoded segments joined by dots: a header describing the signing algorithm, a payload holding the claims, and a signature over the first two. Because the first two segments are only encoded — not encrypted — anyone holding a token can read what is inside it.

This decoder splits a token, shows the header and payload as formatted JSON, and translates the standard time claims (exp, iat, nbf) into readable timestamps, flagging a token that has already expired or is not yet valid. It does not verify the signature, and that distinction matters: decoding tells you what a token says, not whether it is genuine.

The JWT Claims Set represents a JSON object whose members are the claims conveyed by the JWT.

RFC 7519 §4

Features

Expiry read as a real time: exp, iat, and nbf are shown as ISO timestamps rather than raw epoch seconds, with an explicit marker when a token has expired or is not yet valid.
Catches the milliseconds mistake: JWT time claims are in seconds. A token issued with milliseconds decodes to a date tens of thousands of years away; the decoder recognises the magnitude and says so, which turns a baffling auth bug into a one-line fix.
Warns on alg: none: A token whose header declares "none" carries no signature at all. It is called out in red, because a server that accepts one is accepting forged tokens.
Honest about what it does not do: The signature is displayed but never checked. The tool says so above the payload, not below it, so the caveat is read before the claims are believed.
Safe for real tokens: Decoding happens in your browser. The token is not sent to a server, logged, or stored, so you can inspect a production access token without handing it to anyone.

How to use

1
Paste the token
Paste the JWT into the left pane. A leading "Bearer " is stripped automatically.
2
Read the claims
The claims list shows each field with its value, and turns exp, iat, and nbf into readable times.
3
Check the expiry
An expired token is marked in red next to its exp claim; a token that is not yet valid is marked next to nbf.
4
Remember the signature is unchecked
Use the payload to understand what a token claims, never as proof that the claim is true.

Frequently asked questions

Can this tool verify a JWT signature?

No, deliberately. Verifying requires the issuer's secret or public key, and pasting a signing secret into a web page is a bad habit even when the page is trustworthy. Verify in your own code or with a CLI where the key never leaves your machine.

Is a JWT encrypted?

Not by default. A standard signed JWT (JWS) is signed, not encrypted — the header and payload are merely base64url-encoded and anyone with the token can read them. Never put passwords, personal data, or secrets in a JWT payload. Encrypted tokens exist as a separate format (JWE) and look different.

How do I check when a token expires?

The exp claim holds the expiry as the number of seconds since 1970-01-01 UTC. This decoder converts it to a readable timestamp and marks the token as expired when that moment has passed.

Why does my token show a date in the year 50000?

The time claim was issued in milliseconds instead of seconds. JWT time claims are defined in seconds (RFC 7519 §2), so a millisecond value is a thousand times too large. The decoder flags this so the bug is visible.

My token will not decode — what is wrong?

The most common causes are a truncated copy (a JWT must have exactly three dot-separated segments), a value that is a session cookie rather than a JWT, or extra whitespace pasted along with it. The error message says which of the three segments failed.

Is it safe to paste a production token here?

The token is decoded by JavaScript on your own device and is never sent anywhere — this page has no backend. That said, a token is a credential: prefer an expired or test token when you can, and rotate anything you paste into any tool if you are unsure of its provenance.

If you hit this

Specifications this follows

RFC 7519 — JSON Web Token (JWT) — Defines the registered claims exp, iat and nbf as NumericDate — seconds, not milliseconds (§2).
RFC 7515 — JSON Web Signature (JWS) — Defines the three-segment compact serialization and the "alg" header, including why "none" is dangerous.
OWASP — JSON Web Token Cheat Sheet — Why a decoded payload is never evidence that a token is genuine.