PFVPFV Tools
All tools

JWT Decoder

Decode a JSON Web Token to inspect its header and payload.

  • jwt
  • json web token
  • decode
  • jose
  • auth

About JWT Decoder

A JSON Web Token (JWT) is a compact, signed bundle used to carry identity and claims between systems — most commonly an authentication token issued by a backend and presented by the client on each subsequent request. A JWT has three dot-separated parts: the header (which describes the signing algorithm), the payload (the actual claims, like the user ID and an expiry), and a signature that proves the token hasn't been tampered with.

The header and payload are just Base64URL-encoded JSON, so anyone holding the token can read them. The signature is what makes the token trustworthy — but only if you verify it with the correct secret or public key. This decoder reads the header and payload so you can inspect what's inside a token; it does not verify the signature, because verification requires the issuer's secret or public key.

How to use

Paste a JWT into the input at the top. The header and payload panels show the decoded JSON for each part, side by side. If the token has standard claims (iat for issued-at, exp for expiry), a third panel translates those Unix timestamps into readable dates and tells you whether the token has already expired.

The signature is shown raw — you can copy it, but the tool deliberately doesn't try to verify it. Each panel has its own copy button to lift just the header, payload, or signature. A pre-filled sample token loads on first visit so you can see what valid output looks like. Everything happens in your browser; nothing is sent to a server.

Frequently asked questions

  • Why doesn't this verify the signature?

    Signature verification requires the issuer's secret (for HS256/384/512) or public key (for RS256, ES256, etc.) — which you don't want to paste into a random web tool, and which a debugging utility doesn't need anyway. This decoder reads the header and payload so you can see what claims a token carries; verification belongs on the server that actually trusts it.

  • Is it safe to paste a real JWT here?

    Everything happens in your browser — no network request is made, and the token is not stored anywhere after you close the page. That said, JWTs often carry user IDs, email addresses, and authorisation scopes in plain Base64, so treat any decoded payload as sensitive and don't paste a production token onto a shared screen.

  • What do the standard claims like iat, exp, sub, and iss mean?

    iat = "issued at" (Unix timestamp). exp = "expires at" (Unix timestamp). sub = subject — usually the user ID the token represents. iss = issuer — the system that minted the token. aud = audience — who the token is for. nbf = "not before" — when the token becomes valid. These are defined in RFC 7519 and used by most JWT libraries.

  • Why is my token "expired" when the server still accepts it?

    Clock skew. The decoder compares the exp claim against your browser's current time, but the server may have a small grace window for clock drift between machines. A token that's 30 seconds past exp will show as expired here but may still be accepted by a server with a 60-second leeway.

  • Can this decode JWE (encrypted) tokens?

    No. JWE tokens have five dot-separated parts (header, encrypted key, IV, ciphertext, tag) and the payload isn't readable without the recipient's key. This tool decodes JWS tokens — the much more common three-part signed-but-not-encrypted variant where header and payload are just Base64URL-encoded JSON.

More Text & Encoding tools