JWT Decoder — Inspect Header, Payload & Claims
Paste a JWT and inspect its header, payload, and signature. Standard claims like exp, iat and nbf are shown as human-readable timestamps, and expired tokens are flagged. This tool decodes only — signature verification requires the signing key and is out of scope.
Last updated: · Runs 100% in your browser
Result will appear here.// What is the JWT Decoder?
The JWT Decoder splits a JSON Web Token into its three dot-separated parts, Base64url-decodes the header and payload, and renders both as formatted JSON alongside a human-readable view of the standard time claims. Instead of squinting at a Unix timestamp you see when the token was issued, when it expires and whether it is currently valid. Registered claims such as iss, aud, sub and jti are labelled so you can check them against what your API expects. Crucially, decoding happens entirely inside your browser: the token is never transmitted, which is the only responsible way to inspect a token that is still live in a session you control.
// Features
- ▸Split header, payload, and signature
- ▸exp / iat / nbf shown as human timestamps
- ▸Expired token warning banner
- ▸Never transmitted — decoded locally
// How to use
- 01Paste your JWT into the input pane.
- 02Read the decoded header and payload.
- 03Check the expiry banner and standard claims.
// Use cases
- ▸Checking whether an access token has expired during auth debugging.
- ▸Confirming which issuer and audience a token was minted for.
- ▸Inspecting custom claims such as roles or tenant identifiers.
- ▸Verifying which signing algorithm a provider actually used.
// FAQ
Your data never leaves your browser. This tool runs 100% locally — no upload, no logging, no analytics on your inputs.