Web & Network
Decode JSON Web Tokens to inspect header, payload, and claims. No signature verification.
JWT Token box. It expects the standard three-part header.payload.signature format.Token Structure panel appears instantly, showing the header, payload, and signature as color-coded segments.Header panel for pretty-printed JSON — the signing algorithm (alg) and token type (typ).Payload panel for the full JSON body of the token.Claims grid for decoded standard claims like iss, sub, aud, exp, and iat — timestamps are shown in UTC.See exactly what's inside an access or ID token — header, claims, and scopes — without writing any code.
exp, iat, and nbf are converted to UTC, and an expired token triggers a clear warning.
iss, sub, aud, scope, and azp reveal who issued the token, for whom, and what it allows.
See how a token splits into three Base64URL segments — header, payload, and signature — and what each holds.
Any claim beyond the standard set still appears in the grid, so nothing in the payload is hidden.
Everything runs in your browser. Nothing is uploaded, logged, or sent to a server — safe for sensitive tokens.
It Base64URL-decodes the header and payload segments of a JWT and pretty-prints them as JSON, then surfaces the standard claims in a grid. It does not verify the signature.
No. It only decodes. A JWT is trustworthy only if its signature is verified against the correct secret or public key, so never use an unverified token for authentication.
JWT uses a URL-safe alphabet where - and _ replace + and /, and the = padding is omitted. This tool translates those characters and re-pads automatically.
A valid input must have exactly three dot-separated parts (header.payload.signature) and the first two must decode to valid JSON. Missing segments or malformed JSON simply shows no output.
The exp claim is a Unix timestamp in seconds. If it is in the past, the tool warns you and shows the exact expiry time in UTC.
exp, iat, and nbf?They are standard time-based claims stored as seconds since the Unix epoch: expiration, issued-at, and not-before. The tool converts each to UTC for readability.
Never. All decoding happens client-side in JavaScript. Your token is not uploaded, stored on, or logged by any server.