ToolFeather
Developer / SEORuns in your browser

JWT Decoder

Paste a JSON Web Token to read its header and payload — and see when it was issued and when it expires.

Quick presets

JWT Decoder

Header –

  
Payload





  
Claims –

  
Verify signature (HMAC)
Paste the secret to check an HS-signed token. RS/ES tokens need the issuer's public key.




A JWT's header and payload are only Base64url-encoded, not encrypted — anyone holding the token can read them. Decoding happens in your browser; never paste production secrets into sites you don't trust.



  
Runs in your browser — nothing you enter is uploaded or stored.
ToolFeather · Header + payload




Scratchpad auto-saved
Stored in this browser (localStorage)






  
About the JWT Decoder

  
A JSON Web Token (JWT) is three base64url-encoded parts joined by dots: a header describing the signing algorithm, a payload of claims (who the token is for, when it was issued, when it expires), and a signature. Because the first two parts are only encoded — not encrypted — you can read exactly what a token asserts without any secret.


This decoder splits the token, decodes the header and payload, pretty-prints both as JSON, and translates the standard iat, nbf and exp timestamps into human-readable dates, flagging tokens that have already expired. It's the fastest way to answer "what's actually in this token and has it expired?" while debugging authentication.


Important: decoding is not verifying. This tool does not check the signature, so a decoded payload is not proof the token is authentic. All decoding happens in your browser, so tokens are never transmitted.




Examples


Debugging a 401 → paste the bearer token to check whether exp is in the past.


Confirm which user a token is for by reading the sub or email claim.


Check the signing algorithm in the header (alg) — e.g. HS256 vs RS256.








Frequently asked questions
4 answers
Does this verify the token's signature?
No. It only decodes the header and payload so you can read them. Verifying authenticity requires the signing key and should be done server-side.
Is it safe to paste a token here?
Decoding happens entirely in your browser and nothing is uploaded. Still, avoid pasting long-lived production tokens for accounts you don't own.
Why is my payload unreadable?
If the middle segment isn't valid base64url JSON, the token may be malformed or encrypted (a JWE rather than a JWT).
What are iat, nbf and exp?
Standard claims: issued-at, not-before, and expiry — all Unix timestamps, which this tool converts to readable dates.