Skip to content
ToolQivo

JWT Decoder

Decode a JWT and read its header, claims and expiry in plain English.

Developer Tools Reviews Free · no sign-up

Decoding is not verification. The payload is only base64url-encoded, so anyone holding the token can read it — which is also why a JWT payload must never carry a secret.

Quick Tool Overview

The JWT Decoder splits a token into its header and payload, formats both as JSON, names the registered claims and converts the timestamps into readable dates with a plain statement of whether the token has expired.

What it does
Decodes a JWT’s header and claims
You give it
A JWT, with or without a Bearer prefix
You get back
Formatted claims, readable dates and an expiry verdict
Best for
Debugging auth failures and inspecting access tokens
Developer Tools Free, unlimited use No sign-up Runs in your browser

About the JWT Decoder

A JWT is three base64url segments separated by dots, and the first two are only encoded, not encrypted — anyone holding the token can read them. This decodes both and presents them as formatted JSON, with the standard claims named.

The timestamps are the useful part. exp, iat and nbf are seconds since the epoch, which nobody can read at a glance, so they are converted to dates and to a plain statement of whether the token has expired and by how long. Registered claims are labelled, an alg of "none" is flagged as the serious problem it is, and the whole thing happens in your browser — which matters, because a JWT usually is the credential.

Key features of the JWT Decoder

Timestamps made readable

exp, iat and nbf become dates and a plain statement such as "expired two hours ago", rather than a ten-digit number.

Registered claims named

iss, sub, aud, jti and the rest are labelled with what they mean, so an unfamiliar token is still legible.

Dangerous headers flagged

An alg of "none" is called out as the serious problem it is, rather than displayed as an ordinary value.

Clear about what decoding proves

Decoding is not verification, and the page says so — the signature is checked by the JWT Verifier.

The token never leaves the tab

Decoding happens in your browser, which matters because a JWT is usually a live credential.

How to use the JWT Decoder

  1. 1

    Paste the token

    With or without a "Bearer " prefix; both are accepted.

  2. 2

    Read the header

    The algorithm and key id, which tell you how it was signed.

  3. 3

    Read the claims

    Registered claims are named and timestamps converted to readable dates.

  4. 4

    Check the expiry

    The tool states whether the token is live, and by how much.

Frequently asked questions

No, and that distinction matters. Decoding just reads the payload; anyone can do it. Verifying checks the signature against a key, which is what proves the token was not forged. Use the JWT Verifier for that.

Reviews of the JWT Decoder

What people who use the JWT Decoder think of it. Reviews come from visitors and are posted as written.

No ratings yet

Yours would be the first.

  • 5 0 reviews rated 5 stars
  • 4 0 reviews rated 4 stars
  • 3 0 reviews rated 3 stars
  • 2 0 reviews rated 2 stars
  • 1 0 reviews rated 1 star

Write a review

Used this tool? Your rating helps the next person decide.

Your rating

Plain text only — links, email addresses and HTML are not accepted. Your name and review are shown publicly; nothing else is collected. See the privacy policy.

0 reviews

Newest first

No reviews yet

Be the first to rate the JWT Decoder. It takes half a minute and no account.

Write the first review

More developer tools