JWT Decoder
A JWT is three base64url parts separated by dots - header, payload, signature - and almost every debugging session starts with 'what's actually in this token?'. Paste it here and the decoder unpacks the first two parts into clean JSON, names the algorithm, counts the claims, and translates the unix timestamps into plain language: expired 3 hours ago, issued in 2 days, not yet valid for 40 minutes.
Two boundaries are stated up front: signatures are never verified (decoding proves readability, not authenticity), and the token never leaves the browser - by design there is no URL state, so a pasted token can't leak into a shared link. This makes it safe for the tokens you actually debug: session JWTs, OIDC id_tokens, service-account tokens from cloud consoles.
Header
Payload
How to use
- Paste the full token - all three dot-separated parts.
- Read the header and payload as JSON, with alg and claim count.
- Check the expiry line - exp, iat and nbf in relative and absolute terms.
Frequently asked questions
What are the three parts of a JWT?
Header (algorithm and type), payload (the claims - subject, expiry, roles, whatever the issuer put in), and signature (the cryptographic proof over the first two). The first two are base64url-encoded JSON and readable by anyone; this decoder unpacks exactly those.
Can a JWT be read without the secret?
Yes - the header and payload are encoded, not encrypted. Anyone holding the token can read every claim; the secret only matters for changing them, which the signature prevents. Treat JWTs like postcards, not sealed letters.
How do I know if a JWT is expired?
The exp claim is a unix timestamp; expired means exp is in the past. This decoder states it in both relative (3h ago) and absolute (2026-09-13 21:00) terms, and also honors nbf (not-before) for tokens that activate later.
Is my token safe pasted here?
Everything runs in your browser with zero network calls, and unlike other tools on this site, this one deliberately has no share-with-data URL state - a token must never travel inside a link. That said, pasted tokens are still tokens: revoke anything sensitive you wouldn't paste into your own terminal.