JWT Decoder
Decode and inspect JSON Web Tokens — header, payload claims, expiry status, and timestamps.
JWT
Decode JSON Web Token
Client-side only. The signature is displayed but not verified.
Paste a JWT with three Base64URL segments separated by dots.
Help
How to Use the JWT Decoder
A valid JWT has exactly three Base64URL segments separated by dots: header.payload.signature. Paste the full token string into the input area.
Click Decode to parse the token. The header, payload, and raw signature are shown in separate sections. All three parts are decoded client-side — nothing is sent to any server.
The payload section lists every claim. Timestamp fields — iat (issued at), exp (expires), nbf (not before), auth_time — are automatically displayed as human-readable UTC dates.
If an exp claim is present, the tool shows whether the token is still valid or expired, with the exact time remaining or elapsed.
alg (signing algorithm, e.g. HS256, RS256) and typ (token type, usually JWT).sub, iss, aud, exp) and custom application claims.iat = issued at · exp = expires · nbf = not valid before. All shown as Unix seconds and UTC date.