JWT decoder

How to decode a JWT

Paste the full token, all three parts separated by dots, into the input pane and click Convert. The Base64URL header and payload are decoded and printed as formatted JSON. Below them, the iat, nbf and exp claims are shown as ISO 8601 dates in UTC, with a status line that says whether the token has expired.

Why decode a JWT

Reading a token's claims helps a lot when you debug login and auth. You can check the subject, scopes, issuer and expiry without other tools.

Decoding, not verification

This tool reads what's inside the token but doesn't check the signature. It can't tell you whether a token is real, only what it claims.

Tokens stay on your device

Tokens are decoded in your browser and nothing is sent anywhere. You can inspect a token without handing it to a third party.

Common claims

Most tokens carry a few standard claims. iss is the issuer that created the token, sub the user or client it is about, aud the service it is meant for, exp the expiry time, iat when it was issued, and nbf the time before which it must not be accepted. Providers such as Auth0, Firebase and Azure AD add their own claims for roles, scopes and email.

Before you start

Input: TXT and JWT. Output: Decoded token. The settings appear before anything runs, so you can check them first. Your original file is never changed.

The value you enter is processed in your browser. Still test the output where it will be used. Clean formatting does not prove the data is safe or correct.

Keep the original until you have opened and checked the result. The work happens in this browser tab, so the size you can handle depends on your device's memory, your browser and the file itself.

How to use the JWT decoder

1. Paste the full JWT, all three dot-separated parts, into the input pane.
2. Click Convert to decode the header and payload.
3. Check the claims and the expiry status.