JWT Decoder
Decode JWT header and payload (signature is not verified).
About this tool
Inspect JSON Web Tokens by decoding the header and payload segments. See algorithm, expiry, and common claims with human-readable dates. Signature is shown but not verified — for debugging only.
What you get
- Decoded JWT header (algorithm, type, kid, …)
- Decoded payload claims with exp/nbf/iat as dates
- Expired / not-yet-valid indicators
- Raw signature segment and copy buttons
How to use
Paste a JWT (three base64url parts). Review header and payload JSON. Do not treat the result as proof the token is valid.
FAQ
How to decode a JWT token online?
Paste the three dot-separated Base64url segments. Header and payload JSON appear with human-readable dates for time claims.
What information is in a JWT payload?
Typical claims include subject, issuer, audience, expiration (exp), issued-at (iat), and custom app fields—all visible after decoding.
Can I verify a JWT signature with a decoder?
Decoding shows the signature segment but does not prove the token is authentic. Verification requires the issuer's secret or public key.
What do exp, iat, and nbf claims mean?
exp is expiration time, iat is issued-at, and nbf is not-before. The tool flags tokens that are expired or not yet valid.
By using this tool you agree to our Terms of Use and Privacy Policy. Results are provided as-is without warranty.