JWT Decoder
Decode and inspect JSON Web Tokens — header, payload, and human-readable expiry — entirely in your browser. The signature is never verified; this is a decode-only inspector.
Decoded locally · token never uploadedSignature is not verified — decode only. Always verify server-side.
Decoded header will appear here.
Decoded payload will appear here.
How it works
A JSON Web Token is three base64url-encoded parts joined by dots: header.payload.signature. The header names the signing algorithm, the payload carries the claims, and the signature protects both against tampering. This tool splits the token on the dots, converts each base64url segment back to text with your browser's native atob(), and pretty-prints the resulting JSON — all locally, so the token never leaves your device.
Registered time claims (iat, nbf, exp) are Unix timestamps in seconds. They are converted to readable UTC and local dates via the Date API, and exp/nbf are checked against the current time to classify the token as valid, expired, or not yet valid.
Decoding is not verification. Anyone can read a JWT's payload — it is merely encoded, not encrypted. Only the signature proves the token was issued by the expected party and has not been altered, and verifying it requires the issuer's secret (HMAC) or public key (RSA/ECDSA). Treat the decoded output as informational only, and always verify the signature on your server with the correct key and expected algorithm before trusting any claim.
Frequently asked questions
Does this verify the token's signature?
Is my token sent anywhere?
atob() and the native JSON parser. Your token — including any bearer credentials it contains — never touches a server, is never logged, and is never stored.How are the expiry claims interpreted?
iat, exp and nbf claims are Unix timestamps in seconds. This tool multiplies them by 1000 and passes them to the JavaScript Date API to show both UTC and your local time, then compares exp and nbf against the current time to report whether the token is valid, expired or not yet active.What does "malformed token" mean?
header.payload.signature — each base64url-encoded, with the header and payload decoding to valid JSON. If any part is missing, incorrectly padded, or not valid JSON, the token is malformed and cannot be decoded.