JWT Decoder
Paste a JSON Web Token to see its decoded header and payload. Runs entirely in your browser — the token is never sent anywhere.
This only decodes the token's contents — it does not verify the signature. A decoded token is not proof that it's genuine or hasn't been tampered with.
How it works
A JWT is three Base64URL-encoded segments separated by dots: a header, a payload, and a signature. The header and payload are just JSON — anyone can decode them without a secret key, which is exactly what this tool does, entirely in your browser. The signature segment is what actually proves a token is genuine, and decoding it doesn't verify anything; only whoever holds the signing secret (or public key) can do that.
Common claims
exp— expiration time (shown converted to a readable date above)iat— issued-at timesub— the subject the token is about, often a user IDiss— who issued the token
A worked example
The header eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9 decodes to alg HS256 and typ JWT. A payload of eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkphbmUgRG9lIiwiZXhwIjoxODkzNDU2MDAwfQ decodes to sub 1234567890, name Jane Doe and exp 1893456000. The exp line is shown as 1893456000 (2030-01-01T00:00:00.000Z): the number is a count of seconds since 1 January 1970, and the tool adds the UTC date next to it. Join the two with a dot and add any third segment to try it, since the signature is not read.
What the tool does with what you paste
- Spaces and line breaks around the token are trimmed, then the text is split at the dots. It must give exactly three parts, or you see the message about a header, payload and signature.
- The first two parts are Base64URL-decoded as UTF-8 and parsed as JSON. If either step fails you see "Couldn't decode this token".
- Only exp, iat and nbf get a date, and only when the value is a number. Every other claim, and every header field, is shown as plain JSON.
- All dates are in UTC (the Z at the end), not your local time zone. The signature part is never decoded, so a token whose third part is empty or made up still decodes.
Common reasons a token will not decode
- A leading Bearer prefix, as copied from an Authorization header. The word Bearer becomes part of the first segment, so it no longer decodes to JSON. Remove it and paste only the token.
- An encrypted JWT (JWE) has five dot-separated parts, not three, and is reported as not looking like a JWT. Its contents cannot be read without the key.
- A session ID or API key that is not a JWT has no dots or the wrong number of them, so it is rejected the same way.
Guides
- How JWTs Work: Header, Payload, Signature — What the three parts of a JWT hold, what decoding does and doesn't prove, and how to read expiry claims safely.
- Unix Timestamps and Time Zones: Seconds vs ms — Seconds versus milliseconds, UTC versus local time, and the year 2038 limit, plus the mistakes that produce wrong dates.
Frequently asked questions
Does this verify the token's signature?
No — it only decodes the header and payload, which anyone can read without a secret key. Verifying a signature requires the secret or public key used to sign it, which this tool never asks for or needs.
Is my token uploaded anywhere?
No — decoding happens entirely in your browser. Since a JWT often contains sensitive claims, that matters: nothing is sent to a server.
Why did it say this isn't a valid JWT?
A JWT always has exactly three dot-separated parts (header, payload, signature). If your input has more, fewer, or parts that aren't valid Base64URL-encoded JSON, it can't be decoded.
Why does exp show a date tens of thousands of years away?
JWT time claims are in seconds, and the tool multiplies by 1,000 to get milliseconds. If a token's exp is already in milliseconds, such as 1700000000000, it is multiplied twice and shows a year around 55840. That is a sign the issuer used milliseconds.
Can I paste a token with the Bearer prefix?
No. Everything before the first dot is read as the header, so the word Bearer becomes part of it and the header no longer decodes to JSON. You get the "Couldn't decode this token" message. Remove "Bearer " first.
Are the times shown in my local time zone?
No, they are UTC. The tool prints the ISO form ending in Z next to the raw number, so the same token reads the same everywhere.