JWT decoder
DevNo. 39 / 84
Paste a JSON Web Token and read its header and payload as formatted JSON with claim timings — signature not verified, inspection only.
we read the envelope, not the seal. the seal is somebody else's job.
work surface
Math, not advice — results are indicative.Read the disclaimer.
most-used utilities
Inspect a login token
See which roles or scopes the identity provider actually put in the payload.
Check the expiry
Compare exp with your current time instead of guessing why the session dropped.
Confirm the algorithm
Read the header before debugging a signature mismatch; HS256 and RS256 need very different keys.
pro tips
A JWT is signed, not encrypted. Everything in the payload is readable by anyone holding the token, including the parts you would rather keep quiet.
Check exp against your own clock, then check iat and nbf for clock skew. A server two minutes behind can reject a token that looks fine here.
Never paste a production token into a random site. This one runs locally, but a token is still a credential with a working expiry.
what it does
A JSON Web Token is three base64url chunks joined by dots: a header, a payload and a signature. Paste one and this tool splits it, decodes the first two and prints them as readable JSON, with the algorithm, issue time and expiry pulled out into their own cards.
It is the tool you want while debugging a login flow: check which scopes or roles came back, confirm the token was issued by the service you expected, or find out whether a session really expired or the app is just being dramatic about it.
Take a token whose payload reads sub 1234567890, iat 1699996400 and exp 1700000000. That expiry is 14 November 2023 at 22:13:20 UTC, and the widget converts it to your local clock, labels it expired and keeps the date in a copyable card. Claims are read as seconds; the same moment in milliseconds is 1700000000000, three digits longer and a reliable source of 1970 confusion.
The signature is displayed as a length and nothing more. Verifying it needs the secret or the public key, plus the exact algorithm the issuer used, and none of that happens here. Treat this as a reader, not a bouncer: a token that decodes beautifully can still be forged, expired or meant for someone else.
quick answers
Does this verify the signature?
No. It decodes the header and payload only. Verification requires the signing secret or public key and belongs on a server with a proper library.
Is it safe to decode a JWT here?
The decoding happens in your browser and nothing is uploaded, but a JWT is still a credential. Use test tokens for debugging and avoid pasting live production ones anywhere.
Why does my token only have two parts?
It is probably truncated or not a JWT at all. A signed token has three sections, and the third may be empty only when the algorithm is none.