JWT Decoder

Decode a JSON Web Token header and payload, convert iat, nbf and exp to readable dates, and see whether it has expired. Tokens stay on your device.

Runs on your device

Result

Results appear here as you type.

What it does

When an API returns 401, the token is often expired or carries the wrong audience. Paste the token to read its claims. Decoding happens locally because tokens are credentials; avoid pasting production tokens into server side decoders.

How to use it

  1. Paste the token (with or without the "Bearer " prefix).
  2. Read the header, payload and time claims.
  3. Check the expiry status.

Example

The example fills in realistic values and runs the tool. Select Try an example above to see it.

When it helps

  • Debugging authentication errors.
  • Confirming which scopes or roles a token carries.
  • Checking token lifetime settings.

Questions

Does this verify the signature?

No. Verifying needs the secret or public key, which should not be pasted into a web page. Treat decoded claims as unverified.

Is the token sent anywhere?

No. Decoding is a Base64URL and JSON operation done in your browser.

More developer tools

See all 25

People also use

Browse all 200 tools