JWT Decoder
Decode a JSON Web Token header and payload locally. Signatures are not verified.
Private by design. Your input never leaves this browser. Conversions run locally on your device.
What this tool handles
- Splits the token on its dots and base64url-decodes the header and the payload.
- The signature is shown but never verified — verification needs the signing key.
- Registered claims such as exp, iat and nbf are shown as readable dates alongside their raw values.
- A malformed segment is reported rather than guessed at.
Example
JWT
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkFkYSBMb3ZlbGFjZSIsImlhdCI6MTUxNjIzOTAyMiwiZXhwIjoxNzE2MjM5MDIyfQ.dummy-signature-not-verifiedDecoded token
// Header
{
"alg": "HS256",
"typ": "JWT"
}
// Payload
{
"sub": "1234567890",
"name": "Ada Lovelace",
"iat": 1516239022,
"exp": 1716239022
}
// Signature (not verified, shown as-is)
dummy-signature-not-verifiedWhen you would use it
- Chasing down a 401 from an API — Paste the token exactly as it appears in the Authorization header — a leading "Bearer " is stripped for you — and read the sub, aud and scope values the API is actually receiving.
- Telling an expiry apart from a permissions problem — Beside the raw exp the decoder prints either how long the token remains valid or an EXPIRED marker, which settles in one glance whether the call failed because the token lapsed.
- Tracking down which key signed a token — The header's kid is lifted out onto its own line, so it can be matched against an entry in your JWKS when a key rotation has left services disagreeing.
- Spotting a malformed or unsigned token — An alg of "none" is flagged as unsigned and therefore untrusted. Input that does not split into exactly three segments is rejected with the count that was found, which usually means the token was truncated in transit.
Common questions
Why does decoding a JWT not tell me it is valid?
Decoding reverses the base64url encoding and nothing else: it reports what the token claims, not whether those claims are genuine. Confirming that requires the issuer's signing key to recompute the signature, and this tool has no key and requests none, so it never verifies.
Is the payload encrypted?
No. A signed JWT is encoded, not encrypted, so anyone who gets hold of the token can read every claim in it. Nothing secret belongs in a payload.
What is the kid header for?
It names the key the issuer signed with, so a verifier can select the right entry from a JWKS while several keys are live. It is a hint from the token itself, so a verifier must still pin the algorithm it expects instead of trusting the header.
Are exp and iat in seconds or milliseconds?
Seconds since the epoch, as RFC 7519 requires, which makes them ten digits today. Code that passes a millisecond value straight in produces a token that claims to expire thousands of years from now.
Related tools
- Base64 Encode / Decode — Encode and decode Base64 and Base64URL with correct UTF-8 handling.
- URL Encode / Decode — Percent-encode or decode text, or break a full URL into its parts.
- cURL → code — Translate a cURL command into fetch, axios or Python requests code.
- Hash Generator — Compute SHA-256, SHA-384, SHA-512, SHA-1 and MD5 digests of text or a file.