Free Online JWT Decoder

Why use JWT Decoder

• Converts timestamp claims (iat, exp, nbf) to readable dates automatically -- no manual epoch conversion.
• Flags expired tokens immediately, so you diagnose 401 errors in seconds.
• Labels registered claim names (iss, sub, aud, exp, etc.) so you don't have to memorize RFC 7519 abbreviations.

How it works

A JWT is three Base64URL-encoded segments separated by dots. The decoder splits the input on the dot character, then decodes each segment by replacing URL-safe characters (- with + and _ with /) and padding with = signs to standard Base64, which is then decoded with atob(). The header and payload segments are parsed as JSON and pretty-printed with syntax highlighting. Timestamp claims (exp, iat, nbf) are detected by matching known claim names and checking that the value is a plausible Unix epoch (a number greater than roughly 1 billion). These are converted to human-readable dates by multiplying by 1000 and passing the result to the Date constructor. Expiration status is determined by comparing the exp value against the current time via Date.now(). The signature segment is displayed as a raw Base64 string because verifying it would require the signing secret or public key, which should never be entered into a browser tool.

About this tool

Need to figure out why a 401 keeps firing? Paste the JWT from the Authorization header here. You'll see the header, payload, and signature broken out as formatted JSON in under a second. Timestamp claims (iat, exp, nbf) are automatically converted to human-readable dates, and the tool flags whether the token is currently expired with a color-coded indicator. Registered claim names from RFC 7519 -- iss, sub, aud, exp, nbf, iat, jti -- are labeled automatically so you don't have to memorize abbreviations. This is a decoder, not a verifier. It doesn't check signatures (that would require your signing key, which should never go into a browser tool). It decodes the Base64URL segments and presents what's inside. Useful for debugging OAuth 2.0 flows, checking whether an identity provider includes the expected scopes and audience, and verifying that short-lived CI/CD tokens rotate correctly.

How to use JWT Decoder

1. Paste the JWT. Copy the token from an Authorization header, a cookie, or localStorage and paste it in.
2. Read the decoded parts. Header, payload, and signature appear as formatted JSON. Timestamp claims show human-readable dates.
3. Check expiration. A color-coded indicator tells you whether the token is expired or still valid.

Use cases

• A 401 Unauthorized keeps firing. Paste the JWT to check whether exp has passed or aud doesn't match the expected audience.
• You're integrating an OAuth 2.0 provider and need to confirm which custom claims (roles, user ID, org) the access token actually contains.
• During a security review, you paste a sample token to verify the algorithm is RS256, not the insecure 'none' algorithm.