Decode a JSON Web Token to see its header, claims and expiry time in readable form, with human-readable timestamps and a clear expired or valid indicator. Decoding only — no signature verification.
Getting started
Paste the complete JWT — three Base64URL segments separated by full stops.
The header and payload are decoded and formatted immediately.
Check the decoded timestamps for issued-at, not-before and expiry claims.
Review the expiry indicator to see at a glance whether the token is still valid.
Why it helps
Converts numeric Unix timestamps into readable dates, including how long until expiry.
Formats the payload as indented JSON so nested claims are easy to scan.
Identifies the signing algorithm from the header, which matters when debugging auth failures.
Runs entirely locally, which is essential given tokens are credentials.
In practice
Debugging an authentication failure by checking whether a token has actually expired.
Confirming which scopes, roles or claims an identity provider is issuing.
Verifying that a custom claim you added is present and correctly spelled.
Learning how JWTs are structured while building an authentication flow.
Everything people ask most about the jwt decoder, answered plainly.
Keep exploring
More from Developer Tools and beyond — most people who use this one reach for these next.
