About this tool
Debugging authentication issues means reading JSON Web Tokens, and pasting production tokens into random websites is a bad habit — a JWT is a credential. This JWT Decoder works entirely offline in your browser, so tokens never touch a server. Paste a token and it instantly base64url-decodes the header and payload, pretty-prints both as JSON, and interprets the registered time claims: issued-at, not-before and expiration are shown as human-readable local and UTC times, with a clear valid or expired badge and a countdown. The algorithm and token type from the header are highlighted so you can spot alg confusion problems early. Malformed tokens get a precise error telling you which segment failed to decode. While the tool does not verify signatures — that requires your secret or public key — it is the fastest safe way to answer everyday questions like which user is this token for, when does it expire, and what scopes does it carry. Keep it bookmarked next to your API client for painless auth debugging.
How to use JWT Decoder
- Paste the JWT into the input box.
- The header and payload decode instantly into readable JSON.
- Check the validity panel for exp, iat and nbf interpreted as dates.
- Copy any claim value you need for debugging.
Frequently asked questions
Is it safe to paste a real token here?
Yes. Decoding happens only in your browser with no network calls, unlike many online decoders that send your token to a server.
Does the tool verify the signature?
No. Signature verification needs your secret or public key; this tool focuses on decoding and inspecting claims safely.
Why does my token fail to decode?
A JWT needs three base64url segments separated by dots. The error message tells you which segment is malformed.
What do exp, iat and nbf mean?
exp is the expiration time, iat the issued-at time, and nbf the not-before time — all UNIX timestamps in seconds, shown here as readable dates.