JWT Decoder
Free online JWT decoder: inspect the header and payload, see issued-at and expiry times plus validity status. Decoding is local, so your token never leaves the browser.
How to Use
- Paste the token
Drop your JWT into the box. A Bearer prefix is fine — it is stripped automatically.
- Review the decoded output
Header and payload render as formatted JSON, with algorithm, issued-at, expiry and validity shown below.
- Copy the payload
Click 'Copy payload' to put the formatted claims on your clipboard for your debugging notes.
FAQ
Does it verify the signature?
No. Verifying a signature needs the secret key, which should never be pasted into a website. This tool only decodes Base64URL and shows the claims; the signature segment is displayed but not verified.
Why does it say the token is expired?
The exp claim is a Unix timestamp in seconds, compared against the current time. If exp is in the past, the status shows 'Expired'.
Which timezone are the times in?
Times are shown in UTC to avoid confusion between machines. Convert to your local timezone as needed.
What if my token is malformed?
A standard JWT has three dot-separated parts: header.payload.signature. Wrong segment counts or failed Base64URL decoding produce an explicit message.