JWT decoder
Paste a token to read its header and claims. Nothing leaves your browser, and expiry times are shown as real dates.
What is inside a JWT
A JSON Web Token has three Base64URL parts separated by dots: a header (algorithm and type), a payload (the claims), and a signature. Spring Security, OAuth providers and most API gateways issue them. Decoding the first two parts is just Base64, which is why anyone holding a token can read its claims.
Use this tool when debugging "401 Unauthorized" errors: check the exp claim to see if the token expired, the aud and iss claims to see if it was issued for the right service, and scope or roles for missing permissions.
Frequently asked questions
Is it safe to paste a real JWT here?
Decoding happens entirely in your browser and nothing is sent anywhere. Still, treat live tokens as secrets: prefer expired or test tokens when you can.
Does this verify the signature?
No. Verifying needs the secret or public key. This tool only decodes the header and payload, which anyone can read.
What are exp, iat and nbf?
Expiry, issued-at and not-before, as Unix timestamps in seconds. The tool converts them to readable dates and tells you if the token has expired.
Why can anyone read my JWT payload?
A JWT is signed, not encrypted. Never put secrets in the payload.