Home / Developer Tools / JWT Decoder
Developer Tools
Inspect header, claims and expiry of a token.
JWT Decoder inspects a JSON Web Token, splitting it into its header, payload (claims) and signature and rendering the claims — including the issued, expiry and not-before times — in readable form.
Paste a JWT (eyJhbGciOi…) into the input and run the tool. The probe splits the token on its dots and base64url-decodes the header and payload.
Input: JWT — e.g. eyJhbGciOi....
The output shows the decoded header (algorithm and token type), the full claims payload pretty-printed, and the signature segment. The exp/iat/nbf timestamps are rendered as human-readable dates. Note: decoding does not verify the signature — it only reads the claims; signature verification requires the signing key.
→ Inspect the claims and expiry of an auth token during debugging.
→ Check which algorithm and key id (kid) a token was signed with.
→ Verify exp/iat/nbf timestamps before accepting a token.
→ Read custom claims added by an identity provider.
No. Decoding only base64url-decodes the header and payload — anyone can read or forge those. Verification requires the signing key or public key to check the signature. Never trust claims from a token you have not verified.
exp (expiry) is when the token stops being valid; iat (issued-at) is when it was issued; nbf (not-before) is the earliest time it is valid. Receivers should reject tokens whose current time is outside the nbf–exp window (allowing for clock skew).
No. The payload is base64url-encoded, not encrypted, so anyone who captures the token can read it. Put only identifiers and non-sensitive claims in a JWT; keep sensitive data server-side keyed by the token’s subject.