Boring Tools

JWT Decoder

Open tool

Decode a JWT's header and payload — no signature verification.

Paste a JSON Web Token (JWT) to read what is inside it — the header, the payload (the claims), and the signature text — with timestamps translated into readable dates. Handy for debugging logins and API calls. It reads the token; it does not prove the token is genuine.

How it works

A JWT is three pieces separated by dots: header.payload.signature. The header and payload are just JSON that has been Base64URL-encoded, which is why anyone can read them. This tool splits the token at the dots, decodes the first two pieces, and pretty-prints the JSON.

If the payload contains exp (expires), iat (issued at) or nbf (not before) as numbers, they are also shown as dates. These claims are counts of seconds since 1 January 1970 UTC; they are converted to your device's local time zone and date format.

The signature is shown exactly as it appears in the token. Checking it needs the secret or public key used to sign the token, which this tool does not have and never asks for.

How to use it

  1. Paste your token into the JWT box. Decoding happens immediately as you type or paste — there is no button.
  2. Read the Header (algorithm and token type) and Payload (the claims).
  3. If the payload has time claims, check the readable dates listed under it.
  4. If a red message appears, the text is not a token this tool can read.

Options & controls

Input

JWT
The full token, three dot-separated segments. Leading and trailing whitespace is ignored. Long tokens wrap onto several lines.
Reset
In the title row. Clears the token and everything decoded from it.

Reading the results

Decoded output

These appear once a token decodes successfully. All boxes are read-only.

Header
The token's metadata as formatted JSON — typically alg (the signing algorithm) and typ.
Payload
The claims as formatted JSON — for example sub (subject), iss (issuer), aud (audience), plus any custom fields.
exp / iat / nbf lines
Listed under the payload when present and numeric: expiry time, issue time, and not-before time, converted to a local date and time.
Signature (not verified)
The third segment, unchanged. It is not decoded or checked.
Warning banner
The amber box at the top reminds you that decoding is not verifying. It is always shown.
Error messages
"This doesn't look like a valid JWT — expected 3 dot-separated segments." when the token does not have exactly three parts; "This doesn't look like a valid JWT." when the header or payload is not valid Base64URL-encoded JSON.

Tips & guidelines

  • A token that decodes fine here is not necessarily valid. Anyone can create a token with any contents; only signature verification by the server that issued it proves it is genuine.
  • Compare exp with the current time yourself — the tool shows the date but does not label a token as expired or valid.
  • Never paste a live production token into a tool you do not trust. This page decodes it locally and does not send it anywhere, but a token is a credential, so treat it like a password.

Limits

  • Signed tokens (JWS) with three segments only. Encrypted tokens (JWE, five segments) cannot be read, because their contents are not readable without the key.
  • There is no signature verification, no key input, and no expiry check.
  • Times are shown in your device's time zone and locale, so they can look different from the UTC values your server logs use.

Saved in your browser

Nothing. The token exists only in the open page and is never sent anywhere.

← All documentation