JWT Decoder
Free JWT decoder. Paste a JSON Web Token to see its header and payload as formatted JSON, with issued-at and expiry timestamps translated to readable dates.
About the JWT Decoder
A JWT decoder that unpacks the header and payload of a JSON Web Token into formatted JSON, and translates its standard unix timestamps (like exp and iat) into human-readable dates.
JSON Web Tokens are the lingua franca of modern authentication: your login session, API credentials and OAuth grants very likely travel as three base64url-encoded segments joined by dots — a header describing the signing algorithm, a payload of claims about you, and a signature. When a login mysteriously fails or an API returns 401, the fastest diagnostic is often simply reading the token. This decoder unpacks the header and payload into formatted JSON and, crucially, translates the timestamp claims into human dates.
Those timestamps answer the most common question — "is this token expired?" — directly: iat (issued at), nbf (not before) and exp (expiry) are unix timestamps that no human reads natively; the decoder prints each as an ISO date and flags plainly whether exp has passed. Nine times out of ten, an authentication bug is an expired token or a clock-skewed nbf, visible here in seconds.
Understand what decoding does and doesn't tell you. JWT payloads are encoded, not encrypted — anyone holding the token can read the claims, which is why secrets never belong in them. And this tool does not verify the signature (that requires the signing key, which should never leave the server): decoding proves what the token says, not that it's authentic or untampered. Verification belongs in your backend with a proper JWT library. Since decoding happens entirely in your browser, pasting production tokens here doesn't expose them — but treat live tokens like passwords anyway and prefer expired ones for debugging.
How to use the JWT Decoder
- Paste your JSON Web Token into the input field.
- Click 'Decode' to parse the token.
- View the decoded Header (algorithm, type) and Payload (claims, timestamps).
- Check the translated timestamps to see if the token is expired.
Worked example
Paste a token starting with `eyJhbGciOi...`, and see exactly what claims it holds, including when it expires.
Frequently asked questions
- Is it safe to paste a real token here?
- Decoding runs entirely in your browser — nothing is transmitted. Still, live tokens grant access to whatever they protect, so prefer expired or test tokens when debugging, as you would with any credential.
- Why doesn't this tool verify the signature?
- Verification requires the secret or public key the token was signed with. A browser tool can't (and shouldn't) hold your signing secrets — verify server-side with a JWT library.
- What are iat, exp and nbf?
- Standard timestamp claims: iat = when the token was issued, exp = when it expires, nbf = the time before which it must be rejected. All are unix timestamps, decoded here into readable dates.
- Can I put sensitive data in a JWT payload?
- No — payloads are readable by anyone holding the token (as this tool demonstrates). Keep secrets server-side; use the payload for identifiers and non-sensitive claims only.
- Can I edit the JWT and encode it again?
- You can modify the payload and base64-encode it, but the new token will be rejected by the server because the cryptographic signature will no longer match the modified payload.
More from Avexora
All Avexora products →Business software from the team behind these free tools.
- CRM
Avexora AI CRM
A CRM and project workspace for growing businesses.
Visit Avexora AI CRM - WhatsApp Business API
AvexWA
WhatsApp Business API platform for broadcasts, chatbots and automation.
Visit AvexWA - AI business ecosystem
Avexora AI EBOS
From a blank page to a live funnel in minutes.
Visit Avexora AI EBOS - Enterprise AI
Avexora AI
Enterprise-grade AI systems for operations and growth.
Visit Avexora AI - AI voice calling
Avexora AI Voice Agents
Your business phone, answered by AI in every language, every hour.
Visit Avexora AI Voice Agents - OMR exam software
Avexora ExamOS
AI-powered OMR scanning and exam management for schools.
Visit Avexora ExamOS
Related tools
Free base64 encoder and decoder. Convert any text to base64 or decode base64 back to text, with full Unicode support — runs entirely in your browser.
Hash GeneratorFree SHA hash generator. Compute SHA-1, SHA-256 and SHA-512 hex digests of any text instantly in your browser — nothing is ever uploaded.
Timestamp ConverterFree unix timestamp converter. Convert epoch seconds or milliseconds to readable UTC and IST dates — or paste an ISO date to get its unix timestamp.
JSON FormatterFree JSON formatter and validator. Pretty-print JSON with 2 or 4-space indentation, minify it for production, and get clear error messages for invalid JSON.