JWT Decoder

JSON Web Tokens are the lingua franca of modern authentication: your login session, API credentials and OAuth grants very likely travel as three base64url-encoded segments joined by dots — a header describing the signing algorithm, a payload of claims about you, and a signature. When a login mysteriously fails or an API returns 401, the fastest diagnostic is often simply reading the token. This decoder unpacks the header and payload into formatted JSON and, crucially, translates the timestamp claims into human dates.

Those timestamps answer the most common question — "is this token expired?" — directly: iat (issued at), nbf (not before) and exp (expiry) are unix timestamps that no human reads natively; the decoder prints each as an ISO date and flags plainly whether exp has passed. Nine times out of ten, an authentication bug is an expired token or a clock-skewed nbf, visible here in seconds.

Understand what decoding does and doesn't tell you. JWT payloads are encoded, not encrypted — anyone holding the token can read the claims, which is why secrets never belong in them. And this tool does not verify the signature (that requires the signing key, which should never leave the server): decoding proves what the token says, not that it's authentic or untampered. Verification belongs in your backend with a proper JWT library. Since decoding happens entirely in your browser, pasting production tokens here doesn't expose them — but treat live tokens like passwords anyway and prefer expired ones for debugging.