JWT Decoder
Decode a JWT header and payload and check its expiry.
Decodes header and payload locally. Signature is not verified.
About JWT Decoder
The JWT Decoder splits a JSON Web Token into its header and payload, pretty-prints both, and reads the embedded timestamps — issued-at, expiry and not-before — telling you at a glance whether the token is still valid. Debugging auth is one of the most common QA tasks, and expired or malformed tokens are behind a large share of mysterious 401s.
Decoding happens entirely in your browser: the token is never transmitted, which matters because real tokens are credentials. Note that decoding is not verification — this tool shows you what the token claims, not whether its signature is genuine.
How to use
- Paste the token (the full xxxxx.yyyyy.zzzzz string) into the "JWT" box.
- Read the decoded "Header" (algorithm, type) and "Payload" (claims) panels.
- Check "Timestamps" — iat, exp and nbf are converted to readable dates, with the expiry status called out.
- "Load sample" provides an example token if you just want to explore the format.
Frequently asked questions
Is it safe to paste a real production token here?
The token is decoded locally and never sent anywhere. That said, treat live production tokens as credentials everywhere — prefer tokens from test environments when you can.
Does this verify the token's signature?
No. The header and payload are just Base64URL-encoded JSON, readable by anyone. Signature verification requires the signing secret or public key and belongs to your backend or a dedicated library.
My API rejects the token but it looks fine here — why?
Check the exp timestamp first (clock skew included), then the aud and iss claims against what the API expects, and confirm the header alg matches what the server accepts. Any of these fails verification server-side while still decoding cleanly.