JWT Decoder

A JSON Web Token is three Base64-encoded sections separated by full stops: a header saying how it was signed, a payload of claims, and a signature. The first two are encoded, not encrypted, which means anyone holding a token can read what is inside it. This tool does exactly that, and shows the result as formatted JSON.

Timestamp claims are the ones people most often need. The decoder converts issued-at, not-before and expiry into readable dates and tells you whether the token has expired and by how long. The standard registered claims are also labelled, so you can see at a glance which value is the subject, the issuer and the audience.

One thing this tool deliberately does not do is verify the signature. Verification requires the secret or public key, and pasting a signing secret into a web page is exactly the habit that leads to leaked credentials. Decoding tells you what a token says; only your server, holding the key, can tell you whether to believe it.

• Decodes the header and payload as formatted JSON
• Converts issued-at, not-before and expiry into readable dates
• Says whether the token has expired and by how much
• Labels the standard registered claims
• Handles URL-safe Base64 and missing padding
• Clear errors for tokens with the wrong shape
• Never transmits the token, and never asks for your signing key

The jwt decoder is used by writers, developers, students, marketers and anyone else who needs the job done once without installing software. Common cases include:

• Checking why an API call is being rejected as unauthorised
• Confirming which user or scope a token represents
• Seeing when a token expires while debugging a session problem
• Inspecting the claims an identity provider actually issues
• Learning how JSON Web Tokens are structured