What is a JWT decoder?
A JWT (JSON Web Token) is three Base64URL-encoded parts joined by dots: a header naming the signing algorithm, a payload of claims such as sub, iat and exp, and a signature. Decoding reads the first two parts. It does not prove the token is genuine; only checking the signature with the right key does that.
Features
- Header and payload as formatted JSON
- iat, nbf and exp as dates in your time zone
- Expired or time-left status
- Accepts tokens with the Bearer prefix
- Recognises encrypted tokens (JWE)
- Runs in your browser; nothing uploaded
How to use the JWT decoder
- Paste the token, with or without 'Bearer '.
- Read the status: expiry, algorithm and whether it is signed.
- Check the claims in the payload.
- Copy the header or payload as JSON if you need them.
Registered claims
| Claim | Meaning |
|---|---|
iss | Issuer: who created the token |
sub | Subject: usually the user ID |
aud | Audience: which service should accept it |
exp | Expiry time, in seconds since 1 January 1970 UTC |
nbf | Not valid before this time |
iat | Issued at |
jti | Unique token ID, used to block reuse |
These names come from RFC 7519. Anything else in the payload is a custom claim chosen by the issuer.
Decoding is not verifying
- Anyone can read a signed JWT's payload; it is encoded, not encrypted. Never put passwords or secrets in one.
- Your server must verify the signature with the expected algorithm and key, and reject
alg: none, before trusting any claim. - Treat a live production token like a password. This page decodes it locally, but test or expired tokens are the safer habit anywhere.
Frequently asked questions
Is the token sent to a server?
No. It is split and Base64URL-decoded by JavaScript in this page. Nothing is uploaded, logged or stored.
Does it verify the signature?
No. Verification needs the secret or public key, which should stay on your server. This tool only reads the contents.
Why does it say expired when the token still works?
Servers often allow a few minutes of clock difference, and some do not check exp at all. The time shown is exactly what the exp claim says.
Can it read encrypted tokens?
No. An encrypted token (JWE) has five parts and needs the key to read. The tool tells you when it sees one.
Last updated 15 November 2026. Made by Criza Labs. Spotted a mistake? Tell us.