Advertisement

Decode a JWT header & payload (signature not verified).

Result
Download
Your result will appear here.

							
Your recent results

Your results will appear here.

Advertisement

About JWT Decoder

The JWT Decoder splits a JSON Web Token into its parts and decodes the Base64Url header and payload into pretty-printed JSON, so you can inspect the algorithm, token type and every claim without hunting for a library. It is a decoder only: the signature is deliberately not verified, and no secret or public key is ever requested.

Timestamp claims get special treatment. When the payload contains iat (issued at), exp (expires) or nbf (not before), the tool converts each one into a readable UTC date — the quickest way to answer the eternal question of whether a token has actually expired.

Paste the full header.payload.signature string and the decoder handles the rest, including tokens whose payload is not strict JSON. Malformed input — fewer than two segments, or invalid Base64Url — produces a clear error instead of silently garbled output.

How to use JWT Decoder

  1. Paste the complete JWT — the header.payload.signature string — into the token field.
  2. Run the decoder.
  3. Read the decoded header (algorithm, type) and the payload claims as formatted JSON.
  4. Check the DATES section for the human-readable iat, exp and nbf timestamps.
  5. Copy the output for your bug report or debugging notes.

Frequently asked questions

No, and it says so in the output. It decodes the header and payload for inspection only. Signature verification requires the signing secret or public key and belongs in your application code, not in a debugging decoder.

The token is sent to the server for decoding only — no key is requested, nothing is verified and uploads are cleaned up automatically. Even so, treat live production tokens like credentials: prefer expired or test tokens when you can.

Yes, decoding tokens is free and requires no account.

Registered timestamp claims: iat is when the token was issued, exp is when it expires and nbf is the moment before which it must be rejected. The decoder converts all three from Unix seconds into readable UTC dates.

A JWT has at least two dot-separated Base64Url segments (header.payload, usually plus a signature). The error means your input is missing a segment — often because the token was truncated when copied from a log or header.

Yes. Only the header and payload segments are needed for decoding, so a header.payload fragment works — useful when a log line cut off the signature.


Popular searches
jwt decoder decode jwt token jwt parser online jwt debugger read jwt payload jwt token decoder
Need help?
Found an issue with this tool? Let our team know.
Report an issue

Add this free tool to your own website — copy and paste the code below.