convert

JWT Decoder

Decode a JSON Web Token's header and payload, with exp/iat/nbf shown as readable dates and expiry status.

Runs on your deviceBatch readyPaste textNew

Paste or drop

Paste text below, or drop a file instead.

0 chars · 0 lines
…or drop a file
Drag and drop, or choose files
TXTJWT

Choose an output

Decode a JSON Web Token's header and payload, with exp/iat/nbf shown as readable dates and expiry status.

The signature is not verified. Tokens are decoded locally and never sent anywhere.

About JWT Decoder

Paste a JSON Web Token and this tool decodes its Base64URL header and payload into readable JSON. It shows the iat, nbf, exp and auth_time claims as ISO dates with relative times, says whether the token has expired, and lists iss, sub and aud. Tokens are decoded in your browser and never sent anywhere.

When it helps

  • Checking why an API returns 401 by seeing whether the access token has expired.
  • Inspecting the scopes, roles or tenant claims your identity provider puts in a token.
  • Confirming which signing algorithm (alg) and key ID (kid) a token uses while debugging verification.

Tips

  • A leading "Bearer " is stripped, so you can paste the whole Authorization header value.
  • Expiry is calculated with your device clock. If the clock is off, the expired status will be too.
  • Encrypted JWE tokens have five parts instead of three and cannot be read without the key; the tool will tell you if you paste one.

Good to know

Quick answers about jwt decoder in your browser.

No. Decoding only reads the contents, which anyone can do. A token is trustworthy only after its signature is verified with the issuer's secret or public key. This tool does not verify signatures.

Not in a standard signed JWT. The payload is just Base64URL-encoded JSON, so never put passwords or other secrets in it.

They are Unix timestamps in seconds. exp is when the token expires, iat is when it was issued, and nbf is the time before which it must not be accepted.

Yes. There is no sign-up, no watermark and no limit on how many files you process.

No. Files are read and processed locally in your browser, so they never leave your device.

The signature is not verified. Tokens are decoded locally and never sent anywhere.

Related tools

DEVJSON FormatterPretty-print and validate a JSON file with 2-space indentation.DEVJSON MinifierStrip whitespace from a JSON file to shrink it.DEVJSON to XMLConvert a JSON file into an XML document.DEVBase64 EncodeEncode any file into a Base64 text string.DEVBase64 DecodeDecode a Base64 text file back into raw bytes.DEVFile HashCompute SHA-256, SHA-1 and SHA-512 checksums for a file.DEVURL EncodePercent-encode the contents of a text file for safe URLs.DEVURL DecodeDecode percent-encoded text back to readable text.DEVNewJSON to YAMLConvert JSON to clean, readable YAML for configs, Kubernetes manifests and CI files.

Part of the Developer Utilities collection.