JWT Decoder with Readable exp and iat Claims

What does a JWT decoder do?

A JSON Web Token is three base64url-encoded segments joined by dots: a header describing the algorithm, a payload carrying the claims, and a signature. Despite appearances, the first two parts are not encrypted — base64url is an encoding, not a cipher — so anyone holding a token can read them. This tool does exactly that: it splits the token, decodes the header and payload into formatted JSON, shows the signature segment as-is, and renders the iat, exp and nbf claims as human-readable dates, flagging an expired exp in red.

Decoding runs entirely in your browser. The token is never transmitted, logged, or stored — which is the only acceptable behavior for a tool that handles credentials.

When to use it

Typical moments: an API suddenly returns 401 and you want to check whether the token simply expired; you're wiring up an OAuth or OIDC flow and need to confirm the identity provider actually put the audience, scopes, or roles you expect into the payload; or you're debugging clock-skew issues around nbf. Decoding answers all of these in seconds.

Treat the token itself with care: a live JWT is a credential — whoever holds it can act as its subject until it expires. That's why this tool deliberately has no share-link feature: a token must never end up encoded into a URL that lands in chat logs and browser histories. And as a rule, never paste production tokens into online tools that upload input to a server; this one doesn't, but many do. For routine debugging, prefer tokens from a development or staging environment.

Example

Paste a token like eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.<signature> and hit Decode. The header pane shows {"alg": "HS256", "typ": "JWT"}, the payload pane shows the sub, name and iat claims with Issued At rendered as a local date underneath, and the signature segment is displayed untouched with a warning that it has not been checked. If the payload carried an exp in the past, the expiry line would show in red — the fastest possible answer to "is this 401 just an expired token?"