Skip to content
ToolsNow
Developer

JWT decoder — read header, payload and claims

Read the header and payload of a three-part JWT while debugging a login or API request. Timestamp claims are shown as UTC dates. Decoding reveals the contents; it does not verify that the token is genuine.

Runs in your browser — your input is not uploaded to ToolsNow.

Decoding happens in your browser. This tool does not send the token to ToolsNow. In the three-part token format used here, the payload is encoded, not encrypted. Anyone with the token can read it, so treat it as a credential.
JWT
0 chars0 words0 lines

Decoding does not verify the signature or prove that a token is valid. Check the signature, issuer, audience and expiry in your application. Do not paste signing secrets or private keys here.

How to use

  1. Paste just the token. Use header.payload.signature without the Bearer prefix or surrounding quotes. Prefer a test token when investigating a problem.
  2. Inspect the claims. Read exp, nbf and iat as UTC dates when present. Compare issuer, subject and audience with what your application expects.
  3. Copy the section you need. Copy header and Copy payload give you formatted JSON. Verify the signature and application rules in your own system before trusting any claims.

Questions

Does a decoded token have a valid signature?

Not necessarily; someone can alter readable claims without producing a valid signature. This tool performs no signature verification. HMAC verification uses the shared secret; asymmetric verification uses the public key, not the signing private key. Your application must also check the expected algorithm, issuer, audience and other requirements.

Is the token uploaded?

The decoder processes the token in your browser without uploading it. That is separate from page analytics. A live bearer token may grant access to whoever holds it, so use a test or expired token where possible and avoid sharing the copied payload if it contains private details.

Why can I read a signed token without a key?

The header and payload of this three-part format are Base64url-encoded, not encrypted. Signing can let a verifier detect changes; it does not conceal the contents. Encrypted five-part JWE tokens are a different format and are not decoded here.

What do exp, nbf and iat tell me?

They are numeric Unix timestamps in seconds: expiry, not-before and issued-at. The tool compares exp and nbf with the device clock when the input changes. It is not a live countdown or a check for revocation, and a token without an expiry claim gets no expiry verdict.

Published by ToolsNow. How tools and sources are checked · Report a problem

Read more

Guide Base64 is not encryption: choose encoding, encryption or hashing Decode a Base64 example, distinguish readable encoding from encryption, and understand why a hash does not make a password or other guessable data secret. Guide How to read a JWT: inspect its claims without mistaking decoding for verification Read a signed JWT's header and claims, interpret expiry timestamps, and check the difference between decoded content and a token your server can trust.

Related tools

JSON formatter & validator Format or minify JSON, check its syntax and sort keys. Base64 encode & decode Encode or decode Base64, including URL-safe variants. URL encode & decode Percent-encode or decode URLs, and inspect the parts. HTML entity encode & decode Escape HTML special characters, or decode entities back. JSON ↔ CSV converter Convert between JSON arrays and CSV, both directions. CSV import doctor Find CSV import problems, review cell changes and download a checked copy.