Header
Inspect fields such as alg and typ. The algorithm value tells you what the token claims was used, but it is not proof that the signature is valid.
JWT Decoder
Decode a JSON Web Token into its header and payload, inspect common claims and read Unix claim timestamps as ISO dates.
JWT inputheader.payload.signature
HeaderDecoded JSON
PayloadDecoded JSON
Standard claims
Decode a JWT to inspect standard claims.
Decode a JWT without sending it to an API
A JSON Web Token normally has three dot-separated sections: header, payload and signature. This decoder Base64URL-decodes the first two sections, parses them as JSON and displays common registered claims. All decoding in this tool happens in browser JavaScript.
Payload
Read the JSON claims carried by the token, including both registered claims and application-specific values.
Registered claims
The tool highlights iss, sub, aud, exp, nbf, iat and jti when present.
Time conversion
Numeric exp, nbf and iat values are interpreted as Unix seconds and shown alongside an ISO timestamp.
Decoding is not verification
Anyone can create a string with JWT-like header and payload sections. Trusting a token requires cryptographic signature verification with the expected key and algorithm plus application-level validation of claims such as issuer, audience, expiration and not-before time. This page intentionally does not ask for secrets or verification keys and does not verify signatures.
Security precautions when inspecting tokens
JWT payloads are encoded, not encrypted by default. Anyone who obtains a normal signed JWT can often read its header and payload. Bearer tokens can also grant access while they remain valid, so avoid posting live production tokens in tickets, chats or public tools. This decoder processes the token locally, but minimizing exposure of active credentials is still the safer operational practice.
Common JWT debugging scenarios
Unexpected expiration
Inspect exp and compare the converted date with the application's clock and intended token lifetime.
Audience mismatch
Check aud when an API rejects a token issued for a different service or client.
Issuer mismatch
Inspect iss when multiple identity providers, tenants or environments are involved.
Token not active yet
Review nbf and iat when clock skew or issuance timing may be affecting validation.
Related developer tools
Frequently asked JWT questions
Can I trust a JWT because it decodes correctly?
No. Correct Base64URL and JSON structure says nothing about authenticity. Verify the signature and the claims your application relies on.
Is a JWT encrypted?
A typical signed JWT is not encrypted, so its header and payload can be decoded by anyone who has the token. Encrypted JOSE formats are a separate mechanism.
Why does the decoder require three parts?
This implementation targets the common compact signed-JWT form header.payload.signature. Other JOSE serialization formats are outside the scope of this page.
Does this page store the token?
The decoding logic runs locally in the browser and does not submit the JWT to a Smart Web Utility API.