Developer Tools · Free browser tool
JWT Decoder
Decode JSON Web Tokens (JWT) instantly on the client-side. View header, payload, and signature data safely with built-in timestamp humanizer.
Encoded JWT
Paste a token — optional Bearer prefix is stripped.
Timestamp humanizer
- Active
exp1893456000
2030-01-01 00:00:00 · in 1236 days
iat1723000000
2024-08-07 03:06:40 · 736 days ago
Header
JSON{
"alg": "HS256",
"typ": "JWT"
}Payload
JSON{
"sub": "1234567890",
"name": "홍길동",
"email": "user@example.com",
"iat": 1723000000,
"exp": 1893456000
}Signature
Rawsignature-placeholder
Decoding does not prove authenticity. Verify signatures in your backend with the issuer's secret or public key.
Frequently Asked Questions
What are the three parts of a JWT, and what does each one do?
A JWT is three Base64URL-encoded segments separated by dots: Header.Payload.Signature. The Header describes the token type and signing algorithm (e.g. HS256, RS256). The Payload carries claims — user id, roles, expiry (exp), issued-at (iat), and any custom fields your API puts there. The Signature is a cryptographic seal over the first two parts; this decoder shows you the raw signature string but does not verify it, because verification requires the secret or public key.
What's the difference between decoding a JWT and verifying it?
Decoding only Base64URL-decodes the header and payload so you can read the claims — anyone can do that without a key, because JWTs are signed, not encrypted. Verifying checks that the signature matches using the issuer's secret or public key, which proves the token wasn't tampered with and came from a trusted party. This tool is a decoder for debugging; it will never claim a token is authentic unless you separately verify the signature in your own backend.
How should I read Unix timestamps like exp, iat, and nbf inside a JWT?
Those claims are stored as Unix time in seconds since 1970-01-01 UTC. This tool detects common timestamp keys (exp, iat, nbf, auth_time) and shows the equivalent local date/time next to each value. For exp specifically, it also badges the token as Expired or Active based on your browser's current clock — useful for spotting clock-skew or stale staging tokens at a glance.
Why decode JWTs locally instead of pasting them into an online debugger?
Production and staging JWTs often contain user ids, email addresses, roles, or other PII in the payload — and sometimes people paste tokens that also appear in Authorization headers alongside secrets. A server-side debugger receives that entire string. This tool never uploads anything: Base64URL decoding, JSON parsing, and timestamp formatting all run in your browser, so sensitive tokens stay on your machine.
Tools You Might Also Need
Explore other free browser-based utilities for sellers, creators, and professionals.
- Developer Tools
JSON Formatter & Validator
Format, beautify, validate, and minify your JSON data instantly with local syntax error highlighting.
Try Tool - Developer Tools
Base64 Encode/Decode
Encode text to Base64 format or decode Base64 strings back to text instantly with full UTF-8 support and zero data leakage.
Try Tool - Developer Tools
UUID/GUID Generator
Generate high-quality cryptographically secure UUID v4 tokens instantly with bulk options and zero server tracking.
Try Tool
JWTs Are Encoded, Not Encrypted — Decode Them Locally
A JSON Web Token looks opaque, but the header and payload are only Base64URL-encoded JSON. Anyone who holds the string can read the claims without a secret key. That is by design — the signature proves integrity, not confidentiality — and it is also why pasting a production token into a random online debugger is risky. User ids, emails, roles, and other PII often live in plain sight inside the payload.
This decoder never sends your token anywhere. Segment splitting, Base64URL decoding (with full UTF-8 support for non-Latin claims), JSON pretty-printing, and timestamp humanizing all run in your browser. Use it to inspect staging or production JWTs while debugging auth flows without leaking those tokens — or any secrets sitting next to them in an Authorization header — to a third-party server.
Remember the hard limit of this tool: it decodes, it does not verify. A valid-looking payload can still be forged if you skip signature checks. Always verify JWTs in your backend with the issuer's secret or public key. Here, the exp, iat, and nbf humanizer simply helps you read expiry state at a glance while you debug.
Related developer utilities on this site: tidy nested claim JSON with the JSON Formatter & Validator , inspect other Base64 payloads with Base64 Encode/Decode , generate fixture ids with the UUID/GUID Generator , or validate claim-parsing patterns in the Regex Tester .