A JWT decoder reads the header and payload of a JSON Web Token without verifying signatures. Useful for debugging auth tokens locally—never paste production secrets into untrusted sites.

This JWT token decoder online parses JSON Web Tokens into readable header and payload JSON. Paste a JWT from OAuth, API gateways, or Auth0 to inspect claims, expiry, and issuer—decode only; signature verification is separate.

Decoding does not validate signatures—a tampered token still decodes. Always verify signatures in your own app before trusting a token.

Never paste production tokens with live privileges into untrusted websites; Utilnivo runs decode locally in the browser.

How to use this tool

Paste the JWT string (three dot-separated parts), view decoded header and payload JSON, and check expiration timestamps.

Worked example

Example: decode an access token to see `exp` (expiry) and `sub` (subject) before tracing a 401 Unauthorized in your API logs.

When to use this

Debugging OAuth and OpenID Connect flows.
Reading claims during integration testing.
Teaching JWT structure in security workshops.

Common examples

Access token from OAuth login → inspect `exp`, `sub`, and `roles` claims.
Staging vs production token → compare `iss` and `aud` without verifying signature locally.
Expired session token → confirm `exp` timestamp against current time in the payload view.
Staging ID token → confirm `aud` matches your SPA client ID before release.
Expired refresh token → verify `exp` claim against local clock skew.

What people search for

jwt decoder
decode jwt token
jwt payload viewer
json web token decoder
inspect bearer token

Common mistakes

Trusting decoded content without signature verification.
Sharing session tokens in screenshots or tickets.
Confusing access tokens with ID tokens.

check jwt expiration time
decode jwt header alg field
compare two jwt payloads

How it works

Paste a JWT (optionally with a Bearer prefix). The tool splits header, payload, and signature, Base64URL-decodes the first two segments, and pretty-prints them as JSON. Common time claims (iat, nbf, exp) are shown as timestamps. Signatures are displayed but not verified.

Limitations

Decoding a JWT does not verify its signature or prove the token is valid, trusted, or unexpired. Do not paste production secrets into untrusted tools.

Privacy and file handling

Your data stays on your device and is not uploaded.

Related JWT Decoder guides

These pages use the same jwt decoder with guides tailored to specific search intents.

FAQ

Frequently asked questions

Does this verify signatures?

No. It only Base64URL-decodes header and payload. Verify signatures with your library and secret/key.

Is my token sent to a server?

Standard decode works on your device on Utilnivo.

Token has two parts only?

Standard JWTs have header.payload.signature. Some opaque tokens are not JWTs and will not decode.

Page last reviewed: July 6, 2026

Related tools

JWT Decoder

JWT Encoder

JWT Generator

JSON Formatter

JSON Compare

XML Formatter

XML Compare

Base64 Encoder & Decoder

What is a JWT decoder?