JWT Decoder
JSON Web Tokens (JWTs) are the backbone of modern authentication, but they're opaque Base64-encoded strings that are hard to inspect by eye. This tool decodes the three parts of a JWT — header, payload, and signature — and displays the header and payload as pretty-printed JSON so you can immediately see the algorithm, issuer, audience, scopes, and every other claim.
If the token contains an `exp` (expiration) claim, the tool checks it against the current time and tells you whether the token is still valid, already expired, and exactly how long ago it expired or how much time remains. The `iat` (issued at) timestamp is also shown in human-readable form when present.
Everything runs in your browser using standard Base64URL decoding and JSON.parse — your token is never sent to a server. This is a decode-only tool; it does not verify signatures (that requires the signing secret or public key, which you should never paste into a web tool).
By The Paper Room Editorial Team — Developer Tools
Frequently asked questions
Does this verify the JWT signature?▼
No — this tool only decodes the header and payload, which are plain Base64URL-encoded JSON. Signature verification requires the signing secret (for HMAC) or the public key (for RSA/ECDSA), and you should never paste those into a web tool. Use your backend or a local CLI tool for signature verification.
Is it safe to paste my JWT here?▼
The token never leaves your browser — decoding happens entirely in JavaScript on your device. That said, JWTs are bearer credentials: anyone who has the token can use it until it expires. Avoid pasting production tokens in shared or public environments, and prefer tokens from development or staging systems when debugging.
What do the 'exp' and 'iat' claims mean?▼
'exp' (expiration time) is a Unix timestamp after which the token should no longer be accepted. 'iat' (issued at) is when the token was created. Both are standard registered claims defined in RFC 7519. This tool converts them to human-readable dates and tells you whether the token is currently expired.
Why does my JWT have three parts separated by dots?▼
A JWT is three Base64URL-encoded segments joined by dots: the header (algorithm and token type), the payload (the claims — your data), and the signature (a cryptographic proof that the header and payload haven't been tampered with). This tool decodes the first two; the third is a binary signature that isn't meaningful as JSON.