JWT Decoder
Inspect JSON Web Tokens with this free JWT decoder. Paste a token to Base64URL-decode the header and payload, pretty-print claims, and see human-readable exp/iat/nbf timestamps. A clear on-page disclaimer states that signatures are not verified.
Security-conscious engineers use client-side decoders so bearer tokens are not shipped to anonymous third-party APIs. Use this for debugging claim contents only - never as proof that a token is valid for production authorization decisions.
This tool decodes the token only - it does NOT verify the signature. Never paste tokens containing real production secrets from systems you do not own.
Input
Paste or type your content here…
Output
Your result will appear here
Frequently Asked Questions
Does this verify the JWT signature?
No. Decoding Base64URL header/payload never proves authenticity. Treat output as untrusted claims inspection only.
Why show expiry as “Expired X days ago”?
Standard exp/iat/nbf claims are Unix seconds. We convert them to local time and a relative badge so debugging session timeouts is faster.
What if the payload is not JSON?
Some JWT-like tokens use opaque payloads. We still decode the header and label the payload as opaque instead of failing entirely.
Is my token uploaded?
Never. Decoding is local. Still avoid pasting production secrets from systems you do not control.