JWT Decoder — Dev Helper

Warning: this tool only decodes the token (Base64URL → JSON). It does not verify the signature — it does not confirm whether the token is authentic or has been tampered with. Signature verification requires the key/secret and a trusted environment (server). A token decoded here should not be considered valid just because it was read.

Header

Payload

Token dates

Claim	Value (epoch)	Readable date

What is a JWT?

JWT (JSON Web Token) is an open standard (RFC 7519) for transmitting information between parties as a compact, signed JSON object. It is widely used in API authentication and authorization — after logging in, the server returns a JWT that the client sends with every request to prove its identity.

A JWT has three parts separated by dots: header.payload.signature. The header describes the signing algorithm; the payload carries the claims (data such as user, permissions and dates); the signature guarantees that the content has not been altered. The header and payload are only Base64URL-encoded — not encrypted —, so anyone can read them. Never put secrets in a JWT payload.

What this tool does (and does NOT do)

Does: splits the token, decodes the header and payload from Base64URL to JSON and displays them formatted.
Does: converts the time-based claims (exp, iat, nbf) from epoch (seconds since 1970) to a readable date/time and indicates whether the token has already expired.
Does not: does not verify the signature. Without the key/secret, it is impossible to confirm authenticity on a 100% client-side site. Real JWT validation should always happen on the server.

Most common time-based claims

exp (expiration) — the moment the token stops being valid.
iat (issued at) — the moment the token was issued.
nbf (not before) — the moment from which the token becomes valid.

Frequently Asked Questions (FAQ)

Is it safe to paste a production token here?

We recommend not doing so. Treat any JWT token as a credential: even though decoding is local, avoid pasting production tokens into online tools — prefer test/staging tokens for debugging.

Why doesn't the tool validate the signature?

Validating the signature requires the secret key (HMAC) or the public key (RSA/ECDSA) used to sign it, plus a trusted environment. Since this site is static and runs entirely in the browser, exposing or receiving these keys here would not make sense from a security standpoint. Verification should be done by the backend that consumes the token.

What does "Token EXPIRED" mean?

It means the exp claim in the payload points to an instant that has already passed relative to your computer's clock. An expired token is normally rejected by the server. Note that the calculation depends on your device's local time being correct.

Is the token still secure after being decoded?

Decoding does not alter or weaken the token — it only reveals what was already readable (header and payload are Base64URL, not encryption). What protects a JWT is the signature: if someone alters the payload, the signature no longer matches and the server rejects it.