🔑 JWT Decoder

A JSON Web Token (JWT, RFC 7519) is three dot-separated parts — header.payload.signature — and it is the de facto standard for API authentication and session management. The header and payload are simply base64url-encoded JSON, which means they can be decoded and inspected by anyone. Paste a token into this tool and both parts appear instantly as neatly formatted JSON.

The claims you check most often while debugging are the time claims. exp (expiration), iat (issued at), and nbf (not before) are stored as Unix timestamps in seconds, which are unreadable at a glance. This tool converts all three to your local time and shows a clear status badge — expired 🔴, valid 🟢, or not-yet-valid 🟡 — so you can tell in seconds why an API is returning 401 Unauthorized.

One thing matters more than anything else: decoding is not verification. Base64url is an encoding, not encryption, so anyone can read a JWT payload — and this tool does not verify signatures. Whether a token is authentic (untampered) can only be established by verifying the signature server-side with your secret or public key, using a library such as jsonwebtoken or jose. For the same reason, never store passwords or personal data in a JWT payload.

Everything runs locally in your browser — the token is never uploaded, which makes this safer than server-based debuggers. The tool also flags dangerous headers like alg:none. Related tools worth pairing with this one: use the Base64 encoder/decoder to work with individual segments by hand, or the timestamp converter to translate any Unix timestamp.