Skip to content
Home Services Book

JWT decoder. Read the token, keep the secret.

Read the written guide A free online tool by Digital Heroes

Decoded entirely in this browser, the token, and especially the signature, is never uploaded.

§ · written guide

How to use the JWT Decoder

This decoder reads a JSON Web Token and shows its header and payload as formatted JSON. A JWT is three base64url strings joined by dots; the tool decodes the first two, turns the iat, nbf and exp time claims into dates, and tells you whether the token has expired. It is for developers debugging logins, APIs and access tokens, and it does not verify signatures.

Step by step

  1. Paste a token

    Paste the token into the box labeled paste a jwt, or press Load sample to try a demo token. A leading Bearer and space is removed for you, so you can paste an Authorization header value as it is.

  2. Let it decode

    Decoding starts a quarter of a second after you stop typing. The token is shown again under the box in three colors: the header in red, the payload in green and the signature in amber.

  3. Check the status chip

    Next to Decoded, a chip reads Valid with the time left, Expired with how long ago, Not active yet when nbf is still in the future, or No expiry claim when the payload has no exp.

  4. Read the claims table

    Registered claims lists iss, sub, aud, iat, nbf, exp and jti with their meaning. Time claims show the raw number, your local time, UTC and a relative time. Any other key appears as Custom claim.

  5. Copy or clear

    Press Copy above the header or the payload to copy that part as JSON indented with two spaces. Press Clear to empty the box and hide the results.

Reading the result

  • The sample token was issued in May 2024 and expires in September 2030, so its chip reads Valid with the time remaining.
  • iat, nbf and exp are Unix times in seconds. The sample's iat of 1716239022 shows in UTC as Mon, 20 May 2024 21:03:42 GMT, and in your own time zone on the Local line.
  • The Signature card always says NOT verified. It shows the third segment for reference, or notes that there is none when the token is unsecured.
  • Relative times such as in 3 years or 2 days ago are worked out when the token is decoded and do not count down live. Paste the token again to refresh them.

Tips and common mistakes

  • Never trust a payload because it decodes. Anyone can write a token with any claims; only a server that holds the secret or public key can check the signature.
  • If you see Not a valid JWT, the text does not have 2 or 3 parts separated by dots. Check that the copy did not cut off the end or pick up quotes.
  • Header is not valid JSON or Payload is not valid JSON usually means a segment was cut short or changed while copying.
  • The chip checks exp before nbf, so a token that is both expired and not yet active shows Expired.
  • Treat a live token like a password while it is valid. Use expired or test tokens when you share screenshots.

Privacy and limits

Decoding happens in your browser with plain JavaScript. The token is not sent to any server and is not saved, so it is gone when you clear the box or close the tab. Copy writes only to your own clipboard.

Back to the tool

§ 02 · what you can do

Everything a decoder should do.

Decode instantlyPaste any JWT and the header & payload appear as formatted JSON, no setup, no button to press.
Header & payload side by sideBoth segments shown as indented, readable JSON with the raw token colour-coded into its three parts.
Human-readable claim datesTime claims iat, nbf and exp are converted to local and UTC dates with a relative countdown.
Instant expiry statusA status chip tells you at a glance whether the token is valid, expired, or not yet active.
One-click copyCopy the header or payload JSON straight to your clipboard for use in code or docs.
Private by constructionEverything runs in your browser. The signature is never required and never transmitted.
§ 04 · faq

Frequently asked questions.

Is the JWT Decoder free?
Yes, completely free for everyone. No sign-up, no account and no usage limits.
Is it private? Is my token uploaded anywhere?
No upload, ever. Decoding runs entirely in your browser on your own device, so the token, and especially the signature, never leaves your computer and nothing is sent to a server.
Does it verify the signature?
No. This tool only decodes the header and payload. Verifying the signature needs the issuer's secret or public key, which should only ever happen on a trusted server, so don't treat a decoded token's contents as authentic until the signature has been verified.
Does it work offline?
Yes, once the page has loaded, decoding works without a connection because all logic runs locally in your browser.
What does the JWT Decoder actually show?
It splits a JSON Web Token into its header and payload and shows both as readable, formatted JSON. It also converts time claims (iat, nbf, exp) to human dates, shows a valid / expired / not-yet-active status chip, and displays the raw signature segment for reference, all in your browser.

Published · Last updated .

Priya sent you a message Online now

Talk to a Developer Now

Share your name and email to reply.

Reply