About the JWT Decoder
Decode a JSON Web Token and read its header and payload in plain form. A JWT carries three Base64url-encoded segments — header, payload and signature — separated by dots. This tool splits and decodes them locally, showing claims such as issuer, subject, expiry and issued-at as readable values. Nothing is transmitted, which is essential when the token you are debugging is a live credential.
How to use the JWT Decoder
-
Paste the token
Drop in the full JWT, including all three dot-separated segments. Malformed tokens are flagged rather than silently producing partial output.
-
Read the header and payload
The header shows the signing algorithm and token type. The payload lists every claim, with the exp, iat and nbf timestamps converted to readable dates.
-
Check expiry and claims
Confirm whether the token has expired and that issuer, audience and subject match what your application expects.
When to use it
Debugging authentication
Find out whether a request is failing because the token expired, or because a claim does not match what the API requires.
Inspecting scopes and roles
Confirm which permissions an identity provider actually issued to a user.
Verifying token configuration
Check that the algorithm, issuer and audience in a newly issued token match your intended configuration.
Frequently asked questions
Is my token sent to a server?
No. Decoding is pure Base64url parsing done in your browser. This is the single most important property of a JWT decoder, since a token pasted into a server-side tool is a leaked credential.
Does this verify the signature?
No. Decoding and verification are different operations — verification requires the secret or public key. A decoded token tells you what it claims, not whether those claims are authentic.
Is the JWT payload encrypted?
No. The payload is only Base64url-encoded, so anyone holding the token can read every claim. Never put passwords or sensitive personal data in a JWT payload.
What do exp, iat and nbf mean?
exp is the expiry time, iat is when the token was issued, and nbf is the earliest time it becomes valid. All three are Unix timestamps in seconds, shown here as readable dates.
Why does my token fail to decode?
Usually a truncated copy, a missing segment, or a leading "Bearer " prefix included by accident. A JWT needs exactly three dot-separated Base64url segments.
Related tools
Browse all free online tools on Tooly — every one runs in your browser, with no account required.