JWT Decoder
Decode a JSON Web Token to read its header and payload as formatted JSON, with time claims such as exp and iat shown as dates. Decoding happens in your browser and does not verify the signature.
Decoding a JWT does not verify its signature or prove that the token is authentic. Anyone can create a token with any contents, so never trust these claims for access decisions without verifying the signature on your server.
A “Bearer ” prefix is removed automatically. The token is decoded in this browser tab and is not sent anywhere, and no secret or key is needed. Even so, avoid pasting live production tokens into any website.
How to Use the JWT Decoder
- Paste a JWT into the input. A Bearer prefix is removed automatically.
- Read the decoded header and payload as formatted JSON.
- Check the time claims for when the token was issued and when it expires.
- Copy the header, payload or signature separately if you need them.
Examples
Decode a signed token
- Input
- eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyXzEyMyIsIm5hbWUiOiJKYW5lIERvZSIsInJvbGUiOiJlZGl0b3IiLCJpYXQiOjE3NjcyMjU2MDAsImV4cCI6MTc2NzIyOTIwMH0.DqTEh8e4r_4hK2ZHCTbo3h2uOBuDXfXTnBBExN6FG58
- Output
- Header: { "alg": "HS256", "typ": "JWT" } Payload: { "sub": "user_123", "name": "Jane Doe", "role": "editor", "iat": 1767225600, "exp": 1767229200 } Expires: 2026-01-01T01:00:00Z
Malformed token
- Input
- abc.def
- Output
- A JWT has three sections separated by dots (header.payload.signature), but this has 2.
About the JWT Decoder
A JSON Web Token (JWT) is a compact string used to pass claims between systems, most often in login sessions and API authorization headers. It has three Base64URL-encoded sections separated by dots: a header that names the signing algorithm, a payload of claims such as the user ID and expiry time, and a signature.
The header and payload are only encoded, not encrypted, so anyone holding a token can read them. This tool decodes both sections, checks that they are valid JSON objects and shows them formatted. Registered time claims, exp (expires), iat (issued at) and nbf (not before), are shown as dates and compared with your device clock.
Decoding a JWT does not verify its signature or prove that the token is authentic. Verification needs the issuer’s secret or public key and must happen on your server with a trusted library. This tool never asks for keys. Encrypted tokens (JWE, with five sections) cannot be read. Your token is decoded in this browser tab and is not sent anywhere, but treat live tokens as secrets: anyone with a valid token may be able to use it until it expires.
Frequently Asked Questions
Does this tool verify the JWT signature?
No. It only decodes the header and payload. Decoding a JWT does not verify its signature or prove that the token is authentic. Verify signatures on your server with the issuer’s key.
Is it safe to paste my token here?
The token is decoded in your browser and is not sent to a Usevanta server. Still, a valid token can grant access, so prefer test or expired tokens and never share live ones.
Why can anyone read the JWT payload?
Standard signed JWTs are Base64URL-encoded, not encrypted. The signature stops the contents from being changed undetected, but it does not hide them. Do not put secrets in a JWT payload.
What do exp, iat and nbf mean?
exp is when the token expires, iat is when it was issued and nbf is the time before which it must not be accepted. All three are seconds since 1 January 1970 UTC, and the tool shows them as dates.
Why does it say the token is invalid?
A JWT needs three dot-separated sections, each made of Base64URL characters, and the first two must decode to JSON objects. The error message says which section failed and why.
Related Tools
All developer tools →Encode text to Base64 or decode Base64 back to readable text.
Format and validate JSON directly in your browser.
Convert Unix timestamps to dates and dates to Unix timestamps.
Encode or decode URLs and query-string values safely.