A JWT is a compact token made of three Base64URL parts — header, payload and signature — separated by dots. This decoder splits the token and decodes the header and payload into readable JSON, translating time claims (exp, iat, nbf) into readable dates. Decoding happens entirely in your browser.
How to use it
- Paste your JWT.
- The decoded header shows the algorithm and type.
- The payload shows all claims.
- Time claims appear as readable dates.
- Copy any section.
About JWT Decoder
JWTs power modern auth: OAuth, OpenID Connect, API keys and session tokens are frequently JWTs. The payload carries claims about the user or session. When debugging auth you constantly need to see what is inside a token. This makes that instant. Important: decoding does not verify a token — the signature proves authenticity and requires the secret or public key, which this tool never has. Treat decoded contents as informational. Decoding is client-side, so production tokens stay private.
FAQ
Does this verify the signature?
No. It only decodes the header and payload. Verifying the signature is a separate cryptographic step needing the key. Never trust a decoded token as authentic without verifying server-side.
Is my token sent to a server?
No. Decoding happens entirely in your browser.
What do exp, iat and nbf mean?
Standard claims: exp is expiry, iat is issued-at, nbf is not-before. They are Unix timestamps and shown here as readable dates.