JWT decoder
Decode a three-part JWT and inspect its header, claims and expiration. No signature verification is performed; decoded claims are untrusted. Decoded claims are untrusted. A readable token or an unexpired date does not verify its signature or grant access.
Free to use. No email or account required.
Bookmark
Bookmark this tool
Save this short link in your browser’s bookmarks.
Paste this link into the address of a new or existing bookmark.
On desktop, drag JWT decoder to your bookmarks bar.
Only the tool’s link is shared. Your inputs and results are not included.
Share
Your inputs
Edit the example inputs to match your task. Results update as you edit.
Calculations run in your browser. Inputs are not saved or sent to analytics.
How it works
- → Header; Payload
- Header and payload are decoded as UTF-8 JSON. Numeric exp, iat and nbf claims use Unix seconds. Compare exp/nbf with the selected UTC reference (or device clock) and 0–300 seconds of tolerance. These are unverified claim comparisons, never signature or authorization checks.
Input and formula key
Your result
Complete the inputs to see your result.
Sources
- IETF RFC 7519 — JSON Web TokenSources reviewed: 2026-11-07
Assumptions and limitations
Up to 256 KiB. Encrypted five-part tokens are unsupported. Decoded claims are attacker-controlled; expiry alone does not establish authenticity, issuer, audience or authorization. Device clock errors can affect expiry display.
How to use this tool
Set up the inputs
Paste a three-part JWT. Choose the device clock or a fixed UTC reference, clock tolerance and JSON layout. Decode and review the header, payload and dates separately.
Understand the result
Decoded claims are untrusted. A readable token or an unexpired date does not verify its signature or grant access.
Worked examples
-
Check a sample token before expiry
The synthetic example expires at 02:00 UTC on 2025-11-07. At the fixed 01:30 UTC reference, its expiration is in the future; its signature is still unverified.
Frequently asked questions
What are the limits of this tool?
Up to 256 KiB. Encrypted five-part tokens are unsupported. Decoded claims are attacker-controlled; expiry alone does not establish authenticity, issuer, audience or authorization. Device clock errors can affect expiry display.
How should I interpret the result?
Header and payload are decoded as UTF-8 JSON. Numeric exp, iat and nbf claims use Unix seconds. Compare exp/nbf with the selected UTC reference (or device clock) and 0–300 seconds of tolerance. These are unverified claim comparisons, never signature or authorization checks.
Processing and privacy
The calculation or transformation runs in your browser. The tool does not send its input values or generated output to an application server. Loading a page still makes infrastructure requests; optional analytics and Google consent messages have separate controls.
Privacy Policy. Privacy & preferences in the footer controls optional analytics.
Help and feedback
Consult the linked sources for definitions and reference data. Contact Support if you have a question or notice a problem.
Read about calculation methods · Report a problem to emonster
