What this tool does
JWT Decoder checks the three parts of header.payload.signature, decodes the first two parts by Base64URL and parses the JSON. It only decodes text and does not use the key to verify the signature, so successful decoding does not mean that the Token is valid or trustworthy.
- exp, iat, and nbf display Unix timestamps, local time, and UTC simultaneously.
- Header, Payload and Signature are displayed through the secure text API and their contents are not executed.
- Token is not uploaded, written to localStorage, or sent to any target service.
How to use it
- Paste the three-part JWT.
- Click "Decode JWT".
- Check the formatted Header, Payload and original Signature.
- Copy the required Header or Payload respectively.
Common uses
- Debug the Token declaration generated by your own application.
- Check the actual time corresponding to exp, iat and nbf.
- Check the algorithm and type fields declared in the Header.
Privacy and security
JWTs are not saved or uploaded; this page only decodes the readable content and does not verify whether the signature, issuer, audience, or token is valid.
JWT Decoder Features
Locally decodes JWT Header and Payload, and interprets common Unix time claims; does not verify signatures. Useful for everyday development and debugging; results can be reviewed, copied, or downloaded immediately.
FAQ
Does successful decoding mean that the signature is valid?
No. This tool does not verify the signature with a key; it only displays the claims carried by the token.
What is exp for JWT?
exp is usually the Token's expiration Unix timestamp, but acceptance of it should still be verified by a trusted server.
Can I paste the real access token?
The tool does not upload or store content, but real tokens are still sensitive credentials. Avoid exposing them on untrusted devices.
Why do two Tokens report errors?
This page only accepts standard three-part JWT, namely Header, Payload and Signature.