JWT Decoder
Decode a JSON Web Token in your browser: read its header and payload, see every claim with human-readable expiry and issue dates, and catch alg none and expired-token risks before they reach production.
Your decoded token will appear here. Paste a token and press Decode, or load the sample token to see how it works.
Privacy: decoding runs locally in your browser. Your token is never uploaded, stored or logged. Still, prefer a test token over a live production token.
How this calculator works
A JSON Web Token, or JWT, is a compact token with three Base64URL parts separated by dots: header.payload.signature. The header names the signing algorithm and token type, the payload carries the claims (who the token is for, when it was issued, when it expires), and the signature proves the first two parts were not altered. Decoding is not decrypting: Base64URL is only an encoding, so anyone holding a token can read its header and payload. That is exactly why this tool exists, to show you what a token actually contains before you trust it.
Worked example: load the sample token and the header decodes to {"alg":"HS256","typ":"JWT"}, meaning HMAC with SHA-256, while the payload decodes to {"sub":"1234567890","name":"John Doe","iat":1516239022}. The iat claim is a Unix timestamp, so the tool renders it as January 18, 2018, 01:30:22 UTC, the same conversion the Unix Timestamp Converter performs. Every time claim in the payload (exp, iat, nbf, auth_time) gets the same human-readable rendering, and the token status banner answers the question developers actually ask: is this token expired, not yet valid, or still good?
Three things make this decoder safer than pasting tokens into a random site. First, everything runs locally in your browser: the token is never uploaded, stored or logged, so a leaked token cannot leak further through this page. Second, the warnings panel flags the dangerous cases on sight: alg "none" means the token is unsigned and must never be trusted, and a missing exp claim means the token never expires on its own. Third, the signature is shown but honestly labelled display only: verifying a signature needs the server secret or public key, and any tool that claims to verify without one is guessing. For real verification, keep the secret on the server where it belongs.