JWT Decoder & Inspector

Decode any JSON Web Token instantly — header, payload, expiry countdown and security warnings. 100% in your browser; the token never leaves your device.

Decoding happens locally. Even so, treat live production tokens like passwords — prefer pasting test or expired tokens.

How this JWT decoder works

A JSON Web Token is three Base64URL-encoded segments joined by dots: header.payload.signature. The header and payload are plain JSON that anyone can decode — encoding is not encryption. This tool splits the token, decodes both JSON parts with local JavaScript, pretty-prints them, converts every timestamp claim (exp, iat, nbf) to your local time, and runs a live countdown to expiry. It also flags common problems: expired tokens, the dangerous "alg": "none", missing expiry, and tokens that aren't valid three-part JWS structures.

Everything runs on your device — there is no server, no logging, no network request. That matters because real tokens grant real access; pasting one into a website that uploads it is a security risk. For the same reason, this tool decodes and inspects but does not verify signatures — verification needs the issuer's secret or private key and belongs on the server that trusts the token.

Working with the payload JSON afterwards? Format it in our JSON Formatter & Validator, or decode other Base64 data with the Base64 Encoder/Decoder.

Frequently Asked Questions

Is it safe to paste my JWT here?
Decoding is 100% local — nothing is sent anywhere. Still, treat live production tokens like passwords; prefer test or expired tokens when possible.
What are the three parts of a JWT?
Header (algorithm + type), payload (claims like sub/exp/iat and custom data) and signature — a cryptographic checksum of the first two parts made with the issuer's key.
Does this verify the signature?
No. Anyone can decode a JWT, but verifying it requires the issuer's secret (HS256) or public key (RS256/ES256) and belongs on the trusting server. This tool inspects structure and claims.
What do exp, iat and nbf mean?
Unix-second timestamps: exp = expiry, iat = issued-at, nbf = not valid before. The tool converts all three to local time and counts down to expiry live.
Why won't my token decode?
Usually truncation, stray quotes/whitespace from copying, or it's a five-part encrypted JWE rather than a three-part JWS. Copy the complete raw token — a "Bearer " prefix is fine, we strip it.