JWT Decoder
Decode a compact JWT header, payload and numeric dates locally. Inspect the claims while keeping signature verification and authentication clearly separate.
Read the token without trusting it.
IN YOUR BROWSER / PRIVATE INPUTHow to use the
JWT Decoder
- 01
Paste a token carefully
Use a test token where possible. A live bearer token can grant access if exposed through a screen, clipboard or downloaded file.
- 02
Decode the three parts
The decoder parses Base64URL JSON in the header and payload. It accepts the compact three-part JWT form, not an encrypted five-part JWE.
- 03
Verify in the actual application
Read the claims and UTC dates as untrusted data. Use a suitable verification library and policy at the application boundary.
A readable payload is not a verified token
A compact JWT contains a header, payload and signature section separated by periods. Header and payload data are commonly readable Base64URL-encoded JSON. Decoding those sections does not require a signing secret and does not establish that anyone trustworthy created them.
This tool checks that the decoded header and payload are JSON objects and that the compact structure can be read. It never verifies the signature, chooses a trusted key, enforces an allowed algorithm or authenticates the issuer. Every result explicitly says signatureVerified: false.
Inspect a numeric expiry without granting authority
Numeric iat, nbf and exp values are interpreted as seconds since the Unix epoch and shown in UTC when they fit the date range. String values are not silently treated as numeric dates. A token can contain false or misleading values even when its JSON is perfectly well formed.
Payload claim:
{"sub":"demo","exp":1700000000}exp as UTC:
2023-11-14T22:13:20.000Z
Signature verified: falseWhat the decoder does not verify
| Question | Required application responsibility |
|---|---|
| Was this signed by a trusted party? | Verify the signature with an appropriate trusted key. |
| Is this the intended algorithm? | Enforce an explicit allowed-algorithm policy. |
| Is this token meant for this application? | Validate issuer, audience and the relevant token context. |
| Is it currently acceptable? | Apply expiry, not-before, clock-skew and revocation/session policy. |
Keep real credentials out of casual workflows
Prefer a sample token
A live bearer token is secret material even when its payload looks harmless.
Review copied output
Decoded claims may contain personal information. The export is plaintext JSON.
Handle malformed input explicitly
Invalid Base64URL, invalid JSON, missing sections or a JWE structure produce an error rather than a fabricated payload.
JWT Decoder:
questions, answered.
Does this JWT decoder verify a signature?
No. It decodes and parses the header and payload only, and every result explicitly marks the signature as unverified.
Can I decode a JWT without its secret key?
Usually yes for a readable compact JWT. Decoding its Base64URL sections is different from verifying its signature.
Why is a five-part token rejected?
Five-part compact tokens are commonly encrypted JWE structures. This tool does not decrypt them and does not pretend to expose an encrypted payload.
Can I trust an exp date shown by this decoder?
Treat it as an untrusted claim. Signature verification and application-specific time policy must happen before relying on it for authentication.
The calculations and checks above describe this tool's implementation. Use these primary references for the underlying formats and publishing guidance.
JWT specification ↗ (opens in a new tab)JWT security best practices ↗ (opens in a new tab)Read the token without trusting it.
Use the controls above, inspect the actual result and keep the source until you are ready to use your new copy.
Use the JWT Decoder↑