JWT Decoder
Decode JWT claims with exact numbers and expiry times, without verifying the signature.
This tool runs entirely in your browser. Your data is never uploaded, never stored, and never leaves your device.
Inspect exact JWT header and payload values, explain time claims in UTC and download an explicitly unverified report.
How to use it
- 1Paste a three-part JWT without the Bearer prefix.
- 2Decode locally and review the unverified header, claims and time notes.
- 3Copy the relevant JSON or download the inspection report; verify credentials in your application separately.
What happens to your data
Tokens remain in this tab and are not uploaded or stored. This tool never verifies signatures, fetches keys or establishes authentication.
Last updated October 2026
Decode a JSON Web Token into readable header and payload JSON without sending the token to a server. Inspect exact claim values, review common timestamp claims in UTC, and download a clearly labelled inspection report. Large numeric identifiers keep their original digits instead of being rounded through JavaScript numbers.
Decoding and verifying are different operations. Anyone can construct a token containing an administrator claim or a future expiry date. This page does not check a signing key, issuer, audience, revocation state or application policy. A decoded result is untrusted data, not proof that someone is authenticated or entitled to access a resource.
How it works
Paste the three-part compact token without the Bearer prefix and select Decode JWT. The header and payload must use canonical unpadded Base64url and decode to strict UTF-8 JSON objects. Whitespace around the complete token is trimmed, but invalid characters or tail bits inside a segment are rejected. Duplicate object keys are rejected because different consumers may interpret them differently. Five-part encrypted JWE and unencoded JWS payload extensions are not supported.
The exp, nbf and iat claims use NumericDate: a JSON number of seconds since the Unix epoch. The displayed UTC date is limited to millisecond precision, while the original numeric token remains visible. The clock comparison is a snapshot from your device at the moment of decoding. It applies no application-specific clock tolerance and cannot establish token validity. A missing or incorrectly typed time claim is explained rather than silently converted from a quoted string.
Tokens are limited to 32,768 characters, JSON nesting to 32 levels, parsed JSON tokens to 10,000 per segment and formatted output to 100,000 characters per segment. Changing the input removes the previous result and download. The inspection report contains decoded claims, so treat it as sensitive even though the page does not upload the source or persist it in browser storage. Local processing does not protect against an untrusted browser extension or someone else using the same device.
Worked example: read a NumericDate without trusting the token
- Input
- Payload claim: {"exp":1893456000,"id":90071992547409931234}
- Result
- exp: 2030-01-01T00:00:00.000Z; id remains 90071992547409931234
The on-page demo uses alg:none and an empty signature. It is intentionally unsecured, not a valid credential.
Common use cases
- Inspecting a test token while debugging an API
- Understanding exp, nbf and iat without confusing seconds and milliseconds
- Finding duplicate claims or damaged Base64url
- Preserving a long identifier when reviewing a decoded payload
Frequently asked questions
Does this JWT decoder verify a signature?＋
No. It displays the encoded information and checks the supported input structure. A server or a reviewed verification library must validate the algorithm, key, issuer, audience and application requirements before trusting a token.
Why is my token expired but still decodable?＋
Expiry does not erase or encrypt the payload. Decoding shows the claims regardless of their date. The device-clock note is only a reading aid; it is not an authentication verdict.
Why are duplicate claims rejected?＋
Two properties with the same name can lead systems to disagree about the claim value. This tool refuses that ambiguity, including keys written with equivalent JSON escape sequences, rather than displaying only the last occurrence.
Can I decode an encrypted JWT or paste a public key?＋
Encrypted JWE tokens are not supported, and this page does not request keys. It does not contact a JWKS URL or fetch resources mentioned inside a header.
What does alg:none mean?＋
It declares an unsecured token with no cryptographic protection. The demo deliberately uses it. Never interpret readable claims or a future exp value as evidence that such a token can be trusted.
Used in these workflows
Related tools
Base64 Encoder & Decoder
Encode and decode text or files with Base64, Base64URL, data URI detection, preview and download.
JSON Formatter & Validator
Format, validate, and minify JSON with exact line errors, a searchable tree, and private processing.
Hash Generator
Hash text or hex bytes with SHA algorithms, compare an expected digest and download results.
Base32 Encode/Decode
Encode UTF-8 text or hex bytes as RFC 4648 Base32; strictly decode and download exact bytes.