JWT Decoder
Decode JSON Web Tokens (JWT) client-side. Inspect header claims, payload data, expiration times, and token signatures. · Updated
JWT inspection is a privacy-sensitive workflow. This decoder runs locally, warns about live credentials, and disables share links so tokens are never uploaded.
Common errors and fixes
Invalid token: expected 3 parts
A JWT must have header.payload.signature separated by dots. Paste the full token.
Why it happens, with a live exampleFailed to decode Base64URL segment
The token is truncated or corrupted. Copy it again without line breaks or spaces.
Why it happens, with a live examplePayload is not valid JSON
The middle segment must decode to JSON claims. This tool does not verify signatures.
The exp claim is in the past. Decoding still works; treat the session as expired.
Why it happens, with a live exampleOptions
| Option | Description |
|---|---|
| Parse epoch timestamps (exp, iat, nbf) | Translates numeric Unix epoch timestamps into human-readable UTC date and expiration status strings. |
FAQ
Is it safe to paste real JWT authentication tokens here?
Yes. All decoding occurs 100% inside your browser using client-side JavaScript. Tokens are never transmitted to any external server.
Does this tool verify the signature of the JWT?
No. Verifying a cryptographic signature requires a secret or public key. This tool inspects and decodes the claims structure.
How does the tool check if my JWT is expired?
It reads the standard 'exp' (expiration) claim in the JWT payload and compares it against the current client timestamp.
What is the three-part structure of a JWT?
A standard JWT consists of three Base64URL-encoded segments separated by dots: Header (algorithm & token type), Payload (claims data), and Signature.
Why should I avoid sending JWTs to random web tools?
JWTs often contain sensitive user IDs, roles, and session tokens. You should only use verified zero-server tools like Code Beautifier.