JWT Decoder
Read token contents and dates. Signatures are not verified.
Signature not verified. Tokens stay on this page; no URL or browser storage. Limit: 16,384 characters, 32 JSON levels.
- Issued at · iat
- No token decoded
- Expires at · exp
- No token decoded
Related tools
-
JSON formatter
Format, minify and check JSON, with the line and column of the first error. -
URL encoder and decoder
Encode text for URLs or decode percent escapes as you type. -
UUID generator
Create secure random v4 or timestamp-based v7 UUIDs in batches. -
Password generator
Random passwords and word passphrases, with the strength shown in bits. -
Text to Binary
Convert text and byte values in both directions, using ASCII or UTF-8.
Paste a JSON Web Token to read its header and payload as formatted JSON. This helps you inspect claims while debugging an authentication flow or comparing what an application receives with what you expected. The issued and expiry timestamps appear as UTC dates with relative times. Decoding does not prove who created the token, whether its claims are true, or whether a service will accept it. Your input stays in this page and is never saved in browser storage or the URL.
How to use
- Paste a compact token with three dot-separated parts into the input.
- Read the formatted header and payload, then inspect the issued and expiry dates.
- Copy either JSON object for debugging, or clear the input when finished.
What it handles
- Base64url decoding preserves accented letters, combining marks, emoji and other Unicode text.
- Both decoded sections must be JSON objects; arrays, null and malformed JSON show an error.
- Input is limited to 16,384 characters and JSON nesting to 32 levels.
- Missing dates and invalid NumericDate claims have separate labels.
FAQ
Does decoding verify the JWT signature?
No. The signature is not checked, and the tool has no signing key. Readable claims can be forged. Even a date in the future says nothing about trust. Verify the signature, issuer, audience and other required claims in the application that consumes the token before granting access.
Why does my token show a parsing error?
Use the compact three-part format, with dots separating header, payload and signature. The first two parts must contain unpadded base64url that decodes to UTF-8 JSON objects. Encrypted five-part tokens, arrays, invalid byte sequences and deeply nested objects are not supported. Outer whitespace is allowed; whitespace inside a part is not.
How are exp and iat interpreted?
These claims are read as numeric seconds since the Unix epoch, including fractional seconds. The tool shows UTC and a relative time based on your device clock when the input changes or you press Ctrl or Command plus Enter. Strings and out-of-range numbers are labelled invalid; absent claims are labelled missing.
Are tokens stored, and what is the size limit?
Tokens are not uploaded, placed in the address bar or saved in local storage. Reloading loses the input. The 16,384-character limit applies before trimming, and the nesting limit is 32 levels. Clear removes the visible input and results. Any text you explicitly copy remains subject to your clipboard history.
Updated