JWT Decoder — Read Any Token’s Header, Payload & Expiry

Decode any JSON Web Token in your browser: header and payload as readable JSON, every claim explained with human-readable dates, and its expiry status at a glance.

UNDERSTAND YOUR RESULTS

JWT Decoder — Read Any Token’s Header, Payload & Expiry guide

Decode any JSON Web Token in your browser: header and payload as readable JSON, every claim explained with human-readable dates, and its expiry status at a glance.

How to use this tool

Paste the token into the box. Decoding starts automatically when a complete three-part token is present, or click Decode token.
Read the header (algorithm and token type) and payload as formatted JSON, exactly as the issuer encoded them.
Use the claims table to understand each field: registered claims like sub, iss and exp are explained, and exp, iat and nbf are converted to real dates in your timezone and UTC, with a live “expires in …” or “expired …” badge.
Treat what you see as unverified data. The signature segment is shown for completeness, but this tool never checks it — see the warning under the results before you trust anything.

A worked example

The classic example token from jwt.io decodes to a header of {"alg": "HS256", "typ": "JWT"} and a payload of {"sub": "1234567890", "name": "John Doe", "iat": 1516239022} — the decoder renders that iat as 18 January 2018, so instead of doing epoch maths in your head you read the date directly. Load that token with the example button and try it.

How it works

A JWT is three Base64URL-encoded segments joined by dots. The decoder splits the token, Base64URL-decodes the first two segments as UTF-8 JSON (the same encoding rules every JWT library uses), formats them, and interprets the numeric date claims — which the JWT specification defines as seconds since the Unix epoch — as real dates. Malformed input produces a specific explanation (wrong number of segments, invalid Base64URL, JSON that does not parse) rather than a silent blank. Everything runs locally in your browser.

Frequently asked questions

Does decoding a JWT verify it?

No — and the page says so in plain sight. Verification means checking the cryptographic signature with the issuer’s key, which only your server can do properly. A decoded token tells you what the token claims; verification tells you whether to believe it.

Why can anyone read a JWT if it is meant to be secure?

The security of a JWT is its signature, not secrecy of the contents. The payload is signed so tampering is detectable, but it is only encoded — like writing on a postcard in a format machines can read. Never put truly secret data inside a JWT payload.

What does “expired” actually check?

The payload’s exp claim is a Unix timestamp. The decoder compares it with your device’s clock and shows “expired” or “expires in …”. If your device clock is wrong, the badge is wrong with it — servers remain the source of truth.

Why did my token fail to decode?

Usually one of three reasons: it is not a JWT at all (opaque access tokens and API keys have no inside to read), a segment got truncated when copying — JWTs are long — or the payload is not JSON, which a standards-compliant JWT always is. The error message names which check failed.

Is it safe to paste a real token here?

This decoder runs entirely in your browser and transmits nothing — you can confirm that in your browser’s network tab, or by loading the page and going offline. Even so, prefer test tokens when you can, and rotate any token you have pasted into a site you later stop trusting.