How to Decode a JWT Token Online
Paste the token
Copy the full JWT (the three dot-separated parts: header, payload, and signature) and paste it into the input box. Decoding runs automatically in your browser as you type or paste, so you do not have to click Decode first.
Read the header and payload
The base64url header and payload are decoded into pretty-printed JSON. The header shows the signing algorithm (alg) and token type (typ), while the payload lists every claim the issuer placed in the token.
Inspect claims and expiry
Review the claims table for a row-by-row view, where exp, iat, and nbf timestamps are converted to human-readable UTC dates. The expiry badge reads the exp claim and shows Valid, Expired, or No expiry claim at a glance.
What This Decoder Shows You
A JWT has three base64url-encoded segments joined by dots. This tool reads all three and presents each part differently. It decodes and displays the contents but does not verify the signature, which would require the secret or public key.
| JWT Part | What It Holds | How This Tool Handles It |
|---|---|---|
| Header | Signing algorithm (alg) and token type (typ) | Decoded to formatted JSON |
| Payload | Claims such as sub, iss, aud, exp, iat, nbf | Decoded to JSON and to a claims table |
| Signature | Cryptographic signature over header and payload | Displayed as raw text, not verified |
| exp / iat / nbf | Unix timestamps in seconds | Converted to readable UTC dates |
| Expiry status | Whether exp is in the past | Shown as a Valid, Expired, or No expiry badge |
| Processing | Where decoding happens | Runs locally in your browser, no upload |
When to Use a JWT Decoder
Debugging auth flows
Quickly see which claims an identity provider or API gateway issued, confirm the subject and audience, and spot a wrong issuer or missing scope without writing any code.
Checking expiry
When a request returns 401 or a session drops, paste the token to read the exp date in UTC and confirm whether the token has already expired or is not yet valid because of nbf.
Inspecting custom claims
The claims table lists every payload field, so you can verify custom roles, tenant IDs, or feature flags an application embedded in the token.
When NOT to rely on it
This tool decodes only. It does not verify the signature, so it cannot tell you whether a token is authentic or tampered with. Use a server-side library with the key for that.
Common Problems and Fixes
Invalid JWT: expected 3 parts
A JWT must have exactly three segments separated by dots. This error means a segment is missing or you pasted extra text. Remove any surrounding quotes, the Bearer prefix, or trailing whitespace and paste only the raw token.
Failed to decode header or payload
This appears when a segment is not valid base64url JSON, often from a copy that was truncated or line-wrapped. Re-copy the complete token in one piece and make sure no characters were dropped at the edges.
Badge says Expired but the token works elsewhere
The badge compares the exp claim to your device clock in UTC. If your system time is wrong, the status can be misleading. Check your clock, and remember exp and iat are shown in UTC, not local time.
Signature shows but is not checked
The signature segment is displayed as text only. This tool never validates it, so a decoded token is not proof of authenticity. Verify the signature in your backend using the matching secret or public key.