JWT Decoder
Decode a JWT to read its header, payload, and timestamps.
Header appears here
Payload appears here
Common questions
Is my token sent to a server?
No. The token is split and decoded entirely in your browser, so the header, payload, and signature never leave your device. Still, treat any real token as a live credential and avoid pasting production tokens into any online tool.
Does this verify the signature?
No. Verifying a JWT needs the issuer's secret or public key, which only the server should hold. This tool decodes the token so you can read what is inside; it does not and cannot confirm the token is authentic or untampered.
What do iat, nbf, and exp mean?
They are registered time claims in seconds since the epoch: iat is when the token was issued, nbf is the earliest time it is valid, and exp is when it expires. The tool converts each to your local time and notes whether the token has expired or is not active yet.
What are the three parts of a JWT?
A JWT is header.payload.signature, joined by dots. The header and payload are base64url-encoded JSON, which this tool decodes and pretty-prints. The signature is the cryptographic part used for verification and is shown as-is.
Why does it say the token is malformed?
A JWT needs at least a header and a payload separated by a dot, each a valid base64url-encoded JSON object. If a part is missing, not base64url, or not JSON once decoded, the token cannot be read and the reason is shown.