What this tool does
JWT Decoder checks the three parts of header.payload.signature, decodes the first two parts by Base64URL and parses the JSON. It only decodes text and does not use the key to verify the signature, so successful decoding does not mean that the Token is valid or trustworthy.
- exp, iat, and nbf display Unix timestamps, local time, and UTC simultaneously.
- Header, Payload, and Signature are displayed as text without executing their contents.
- Your token is not uploaded, saved automatically, or sent to other services.
How to use it
- Paste the three-part JWT.
- Click "Decode JWT".
- Check the formatted Header, Payload and original Signature.
- Copy the required Header or Payload respectively.
Common uses
- Debug the Token declaration generated by your own application.
- Check the actual time corresponding to exp, iat and nbf.
- Check the algorithm and type fields declared in the Header.
Privacy and security
JWTs are not saved or uploaded; this page only decodes the readable content and does not verify whether the signature, issuer, audience, or token is valid.
JWT Decoder Features
Locally decodes JWT Header and Payload, and interprets common Unix time claims; does not verify signatures. Review the result, then copy it for use.
FAQ
Does successful decoding mean that the signature is valid?
No. This tool does not verify the signature with a key; it only displays the claims carried by the token.
What is exp for JWT?
exp is usually the Token's expiration Unix timestamp, but acceptance of it should still be verified by a trusted server.
Can I paste the real access token?
The tool does not upload or store content, but real tokens are still sensitive credentials. Avoid exposing them on untrusted devices.
Why do two Tokens report errors?
This page only accepts standard three-part JWT, namely Header, Payload and Signature.