JWT decoder
Useful for inspecting access tokens while building APIs. Decoding happens in your browser; the token is not sent anywhere.
Loading the tool…
Processing and privacy: The result is calculated inside your browser and your data is not sent to any server.
How to use it
- Enter jwt.
- The result appears straight away and updates as you edit.
- Copy the result, or copy a link that keeps the same values to share it.
How it is calculated
Token = header.payload.signature, each part Base64URL encoded (RFC 7515). The first two parts decode to JSON; times are seconds since 1970-01-01 UTC. Lifetime = exp minus iat.
Example
Result: Payload: { "sub": "user-42", "name": "Sara", "role": "admin", "iat": 1767225600, "exp": 1767229200 }; Issued at (iat): 2026-01-01 00:00:00 UTC; Expires (exp): 2026-01-01 01:00:00 UTC.
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyLTQyIiwibmFtZSI6IlNhcmEiLCJyb2xlIjoiYWRtaW4iLCJpYXQiOjE3NjcyMjU2MDAsImV4cCI6MTc2NzIyOTIwMH0.tuH3ldu_GsQLMmfc98DrYS9zjD_sHB8GYZJ9PCiSLek
HS256
Limits and caveats
- The signature is not verified, so do not trust the contents until your server checks it with the right key.
- It does not say whether the token has expired right now; compare exp with the current UTC time.
Questions about this tool
Is a JWT encrypted?
No. Signed tokens (JWS) are only Base64URL encoded and anyone can read them, so never put passwords or secrets inside.
Why does the tool not verify the signature?
Verification needs the secret or public key, and secrets should not be pasted into outside sites. Verify on your server.
What do iat, exp and nbf mean?
iat is issue time, exp is expiry, and nbf is the time before which the token is not valid, all in seconds since 1970 UTC.