RSRobince Studio

JWT Decoder

Paste a JSON Web Token to see its decoded header and claims, with issue and expiry times translated into readable dates.

Runs in your browser. Your files are never uploaded.

Loading JWT Decoder…

How to use JWT Decoder

  1. Paste your JWT (the long string with two dots).
  2. Read the decoded header and payload.
  3. Check the exp, iat and nbf dates and whether the token has expired.

Anatomy of a JWT

A JWT is three Base64URL-encoded sections joined by dots. The header says which algorithm signed the token (for example HS256 or RS256). The payload carries the claims, such as who the user is. The signature lets the server confirm that nobody changed the first two parts.

Standard claims you will see

  • iss: who issued the token.
  • sub: the subject, usually a user ID.
  • aud: the intended audience (which API accepts it).
  • exp: expiry time as a Unix timestamp.
  • iat: when the token was issued.
  • nbf: not valid before this time.

Debugging tips

A frequent cause of “unauthorized” errors is an expired token: check exp against the current time, remembering it is in UTC and in seconds. Clock differences between servers can also make a fresh token look “not yet valid” (nbf in the future). Never store sensitive data in the payload: it is encoded, not encrypted, and readable by anyone holding the token.

Why use this jwt decoder tool

  • Readable dates. iat, nbf and exp are shown as UTC dates.
  • Expiry status. Instantly see if a token is expired.
  • Local only. Your token never leaves your browser.

Frequently asked questions

What is a JWT?

A JSON Web Token is a compact, signed string used to pass identity and permission claims between systems, typically after login. It has three Base64URL parts: header, payload and signature.

Does this verify the signature?

No. Verifying needs the secret or public key. This tool only decodes the readable parts, which anyone can do.

Is it safe to paste a token here?

Decoding runs in your browser and nothing is transmitted. Still, treat live tokens as passwords: avoid pasting them on sites you do not trust, and rotate any token you have exposed.

More free tools

PX to REM Converter

Convert pixels to rem and em, and back, with a custom root font size. Includes a table of common sizes from 8px to 64px and a copy-ready CSS declaration.

Open tool

Base64 Encode & Decode

Encode text to Base64 or decode Base64 back to text. Supports UTF-8 and URL-safe Base64. Free, instant and runs in your browser.

Open tool

URL Encode & Decode

Encode or decode URLs and query strings with percent-encoding. Choose component or full-URL mode. Free, instant and private.

Open tool