Skip to main content
Utilnivo

Developer

Utilnivo

JWT Decoder

Decode JWT header, payload, and expiry—including Bearer tokens—on your device.

No registration
  • On your device

Browse more in Developer or all tools.

Private on your device

Your information stays on your device and is not uploaded.

Related tools

What is a JWT decoder?

A JWT decoder reads the header and payload of a JSON Web Token without verifying signatures. Useful for debugging auth tokens locally—never paste production secrets into untrusted sites.

Paste a JWT or Authorization Bearer token to inspect the header (alg, typ, kid), payload claims (sub, aud, roles, custom fields), and expiry status. Common time claims (iat, nbf, exp) are shown as readable timestamps. The signature is displayed but not verified—use this for debugging, not authentication. Decoding runs entirely on your device.

JWTs bundle header, payload, and signature segments. Decoding shows claims such as subject, audience, and expiry—it does not verify that the token was issued by a trusted party or that the signature is valid.

Never paste production bearer tokens into shared machines or screen recordings. Treat decoded payloads as sensitive even when verification is skipped for debugging.

Use JWT Expiry Checker when you only need to know whether a token is expired without reading every claim.

How to use this tool

1. Paste a JWT into the input area. 2. Review decoded Header and Payload JSON in the results. 3. Check algorithm, token type, and time-related claims if present. 4. Copy header, payload, or signature sections as needed. 5. Do not paste production secrets into shared machines.

Worked example

Example: a sample JWT with alg HS256 shows the header algorithm and payload claims such as sub and exp when decoded—signature verification is not performed.

When to use this

  • Inspecting `exp` and `roles` on an access token during login debugging.
  • Comparing staging vs production `iss` and `aud` claims.
  • Confirming a session expired from the payload timestamp.
  • Teaching how JWT header and payload are structured.

Common examples

  • Access token from OAuth login → inspect `exp`, `sub`, and `roles` claims.
  • Staging vs production token → compare `iss` and `aud` without verifying signature locally.
  • Expired session token → confirm `exp` timestamp against current time in the payload view.
  • Staging ID token → confirm `aud` matches your SPA client ID before release.
  • Expired refresh token → verify `exp` claim against local clock skew.

Common mistakes

  • Assuming a decoded token is trustworthy without signature verification.
  • Pasting production bearer tokens into untrusted third-party sites.
  • Ignoring clock skew when reading `exp` and `nbf` claims.
  • Confusing encrypted JWE tokens with plain signed JWTs.

How it works

Splits a JSON Web Token into header, payload, and signature parts and decodes the Base64URL JSON sections. Does not verify signatures or trust token claims—decode only.

Limitations

Decoding a JWT does not verify its signature or prove the token is valid, trusted, or unexpired. Do not paste production secrets into untrusted tools.

Privacy and file handling

Your data stays on your device and is not uploaded.

FAQ

Frequently asked questions

Does this verify the JWT signature?

No. The tool only decodes and displays the header, payload, and signature. It does not validate signatures or trust the token.

What time claims are shown?

When present, iat (issued at), nbf (not before), and exp (expires) are shown as ISO timestamps with a simple status such as expired or active.

Is my token stored?

No. Decoding works on your device and tokens are not stored.

What does the JWT Decoder show?

It Base64URL-decodes the header and payload into readable JSON, including claims like sub, aud, and exp. The signature is shown but not verified.

Can I paste a Bearer token?

Yes. Paste the JWT with or without the Authorization Bearer prefix. Opaque non-JWT tokens will not decode.

Are tokens uploaded to a server?

No. Decoding runs in your browser. Clear the page on shared devices after inspecting sensitive tokens.

Does decoding prove a token is valid?

No. Always verify signatures, issuer, audience, and expiry in your own application before trusting a token.

Part of these workflows

This tool is one step in a longer job. Jump straight to your step or open the full workflow guide.

Related pages

Page last reviewed: