JWT Decoder

A JSON Web Token is just three base64url-encoded segments separated by dots: header.payload.signature. Decoding the first two is pure text transformation — no secret key is involved — which is exactly what this tool does. Paste a token (a leading "Bearer " prefix from an Authorization header is stripped automatically) and it splits the segments into a colour-coded preview, pretty-prints the header and payload as syntax-highlighted JSON, and lays out the registered claims in a readable table.

Everything runs in your browser. The token is never transmitted, logged or stored on any server, so it is safe to inspect real production tokens. The decoder also never asks for your signing secret, because decoding is not verifying: anyone can read a JWT's payload, but only a party holding the secret or public key can confirm the signature is genuine. That distinction is why you should never put sensitive data in a JWT payload.

The time claims get special treatment. exp, nbf, iat and auth_time are converted from Unix seconds into readable dates — switchable between your local timezone and UTC — with relative phrasing like "expires in 42 minutes". A status badge tells you at a glance whether the token is valid, expired or not active yet, and a warning appears if the header declares alg: none, meaning the token is unsigned and trivially forgeable.