ToolBirch

JWT Decoder

Read a JWT's header and payload claims, with expiry times decoded.Developer Tools

JWT Decoder

Decode a JSON Web Token's header and payload to read its claims. Tokens are only decoded — signatures are not verified here.

Paste the header.payload.signature string. Nothing is transmitted or verified.

About this tool

When a request fails authorisation you usually need to see what the token actually claims. Paste it here to read the header, every payload claim, and iat/exp/nbf as human-readable dates — all locally.

How to use the JWT Decoder tool

  1. Paste the token. The full header.payload.signature string, with or without a Bearer prefix stripped by hand.
  2. Read the claims. The header and payload render as formatted JSON; time-based claims become local dates.
  3. Check the signature state. The tool reports whether a signature part is present — it never verifies it.

Supported formats

Input

  • A JWT in header.payload.signature form

Output

  • Formatted header JSON
  • Formatted payload JSON
  • Decoded time claims

Inputs are validated before anything is processed. Invalid values and unsupported files are rejected with a clear error instead of failing silently.

Frequently asked questions

Does this verify the signature?

No. Verification requires the issuer's secret or public key and belongs on your server. The tool decodes and displays only.

Is it safe to paste production tokens?

The token never leaves your browser tab. Still, prefer decoding short-lived tokens you own.

Which claims get date treatment?

iat (issued at), exp (expires) and nbf (not before), the standard NumericDate claims.

What about encrypted JWE tokens?

Not supported. JWE payloads are encrypted, not Base64JSON, and the tool says so rather than showing gibberish.

Privacy

Everything you enter stays in this browser tab. There is no upload endpoint for tool inputs, no account, and no server-side copy of your text or files. Results are produced locally and disappear when you close the page.

No account is required and no file is ever uploaded. See the privacy policy for details about analytics and the limited data this site stores.

Known limitations

  • No signature verification of any kind.
  • Encrypted tokens (JWE) cannot be decoded.
  • Very large tokens with big claim sets are limited by browser memory only.

Related tools

Other free tools from the same collection.

Base64 Encoder / DecoderEncode text to Base64 or decode it back, with correct UTF-8 handling.Hash GeneratorCompute SHA-1, SHA-256, SHA-384 and SHA-512 digests of any text.JSON FormatterFormat, validate and minify JSON with clear error positions.Unix Timestamp ConverterConvert Unix timestamps to dates and dates back to seconds or milliseconds.