DevClamp

JWT Decoder

Decode a JSON Web Token's header and payload, read every claim in plain language, and spot expiry problems — decoding only, never verification. Free, no sign-up — runs locally in your browser.

What is a JWT?

A JSON Web Token (JWT, pronounced "jot") is a compact, self-contained way to carry a set of claims — statements like "this is user 1234", "this session expires at 17:00", "this token may read but not write" — between two systems. It is the token format behind most modern login sessions and OAuth2/OIDC flows: you receive one after signing in, your browser or app attaches it to API requests, and the API reads the claims to decide who you are and what you may do, without a database lookup per request. The whole token is one string of three Base64URL-encoded parts joined by dots, short enough to travel in an HTTP header — and, famously, readable by anyone who holds it.

Decode is not verify — read this first

Two operations are constantly confused, and the confusion has caused real breaches. Decoding is just unwrapping: Base64URL is an encoding, not encryption, so the header and payload of any JWT can be read by anyone, including you on this page. Verifying is the security operation: checking that the signature was produced by a trusted issuer's key over exactly these header and payload bytes, that the algorithm is one you accept, and that the token has not expired. This tool performs the first operation and never the second — it has no keys and no opinion about trust. A beautifully formatted, perfectly decodable token can be completely forged. If you are debugging your own system, decode here to see what a token says; let your server decide whether to believe it.

How to use this tool

  1. Paste the token (a leading Bearer is stripped automatically).
  2. Press Decode. You get the header and payload as formatted JSON, every payload claim translated into a table with its meaning, and the raw signature segment.
  3. Read the warnings first if any appear: expired token, alg: none, an empty signature, or a missing exp — the four things most often wrong with a token in the wild.
  4. Time claims (exp, iat, nbf) are shown both as raw NumericDates and as ISO timestamps, so "is it expired?" answers itself.

The three parts, and the claims that matter

The header is metadata about the token itself: alg names the signing algorithm, typ is usually JWT, and kid identifies which of the issuer's keys signed it — the field key rotation hangs off. The payload carries the claims. The registered names are worth knowing cold: iss (issuer), sub (subject — usually the user id), aud (audience — who may accept this token), exp, iat and nbf (the time claims), and jti (a unique id used for revocation lists). Everything else in the payload is a private claim added by the issuer — roles, tenant ids, feature flags. The signature is computed over the first two segments exactly as transmitted, which is why editing one character of the payload — changing a role, extending an expiry — invalidates it.

Our background guide, What is a JWT?, walks through how tokens are issued, signed and checked in a real login flow, including the algorithm-confusion attacks that made alg: none infamous.

Frequently asked questions

Does this tool verify the token's signature?

No — and no browser tool can do it properly for someone else's tokens. Verification needs the issuer's secret or public key and a policy decision about which algorithms and issuers to trust; that is a server-side job. This tool decodes the header and payload so you can read them, and flags structural problems (expiry, alg none, an empty signature). A token that decodes cleanly here can still be forged — never trust a claim just because you can read it.

Is it safe to paste a JWT here?

This page decodes the token in your browser and sends nothing anywhere — you can disconnect from the network and it keeps working. That said, treat tokens like passwords as a habit: a live session token pasted into a tool that did phone home would be a credential leak. Prefer expired or test tokens when you are just exploring, and never paste a token into a site you have not verified.

What does "decoding" a JWT actually do?

Almost embarrassingly little, which is the point of the format. A JWT is three Base64URL-encoded segments joined by dots. The first decodes to a JSON header (algorithm, type, key id), the second to the JSON payload of claims, and the third is the raw signature bytes. There is no encryption involved in a standard JWT (that is the separate JWE format), so anyone holding the token can read everything in it — including you, right now.

Why does the tool warn that my token has no exp claim?

A token without an expiry never becomes invalid by age; if it leaks, it works until the issuer revokes it or rotates keys. That is occasionally deliberate — some API tokens are designed to be revoked instead — but for login sessions it is a smell worth noticing. The warnings here are prompts to look, not verdicts.

What is the difference between iat, exp and nbf?

iat (issued at) records when the token was created, exp (expires at) when it stops being valid, and nbf (not before) the earliest moment it may be used. All three are NumericDates: seconds since the Unix epoch, not milliseconds — a token whose exp decodes to a date in the year 55000 was probably issued in milliseconds by mistake.

Why does the decoded payload of my token look already expired / wrong?

Check which token you pasted: in OAuth2/OIDC flows the short-lived ID token and the access token travel together and are easy to mix up, and refresh tokens are often opaque (not JWTs at all) — an opaque token fails here with a segment error, correctly. Also confirm you copied the whole token: one missing character in the payload segment corrupts the JSON, and this tool will point at the segment rather than guess.

Related tools

Base64 Encoder / Decoder

Encode text to Base64 or decode Base64 back to text — UTF-8 safe, with a URL-safe variant, entirely in your browser.

URL Encoder / Decoder

Percent-encode text for URLs or decode percent-encoded strings — with component and full-URL modes and precise error locations.

JSON Formatter & Validator

Format, validate and inspect JSON in your browser, with precise error locations and a collapsible tree view.

Related guides

What Is a JWT? JSON Web Tokens Explained

A JSON Web Token is three Base64URL segments and a signature. How JWTs are structured, how the claims work, how verification really happens, and the mistakes that make them insecure.