JWT Decoder
Decode JWT header, payload and claims — with readable expiry timestamps.
The JWT Decoder unpacks any JSON Web Token into its three parts — header, payload and signature — with the payload beautifully pretty-printed and standard claims highlighted. Paste an access token or id_token and immediately see what it contains: who issued it, who it is for, and when it expires.
Standard claims like exp (expiry), iat (issued at), nbf (not before) and aud (audience) are detected automatically, and numeric timestamps are converted to readable UTC dates so you can tell at a glance whether a token is still valid. Custom claims are listed separately with their values.
Decoding is fully offline — the token never leaves your browser, which matters because JWTs are credentials. Note that decoding does not verify the signature: to check authenticity you must validate the signature with the issuer's key, which this page does not do.
Paste any JWT (from an id_token, access token or request header) to see its header, payload and claims — fully offline in your browser.
How to use the JWT Decoder
- Paste a JWT (header.payload.signature).
- Read the decoded header (algorithm and type).
- Read the pretty-printed payload JSON.
- Scan the claims list — expiry timestamps appear as readable UTC dates.
- Copy any part you need; nothing was transmitted anywhere.
Frequently asked questions
What is inside a JWT?
Three dot-separated Base64url parts: a header describing the signing algorithm, a payload of claims about the user and session (like exp, iat, iss, sub), and a signature that authenticates both. This decoder shows the first two and the signature string.
Is decoding a JWT safe?
Yes — the header and payload are not encrypted, only encoded, and this tool reads them locally. The signature is what makes a token trustworthy, and verifying it requires the issuer's secret or public key, which this page does not attempt.
How do I check if a JWT is expired?
Look at the exp claim: it is a Unix timestamp in seconds. The decoder converts it to a UTC date so you can compare with now — an expired token has exp in the past and should be rejected by any compliant server.
Related tools
View all developer tools →JSON Formatter & Validator
Format, minify and validate JSON instantly with clear error messages that point at the exact problem.
Dev ToolsJSON Validator
Check if your JSON is valid and find syntax errors with exact line and column.
Dev ToolsJSON Minifier
Compress JSON to its smallest valid form for storage and transport.
Dev ToolsJSON to CSV
Convert a JSON array of objects into a clean CSV file in one click.
Dev ToolsCSV to JSON
Convert CSV (from Excel or Google Sheets) into a JSON array of objects.
Dev ToolsBase64 Encoder
Encode text or files to Base64 — standard or URL-safe — in your browser.