Json Beautifier
Guides

JWT Decoder

Read what is inside a token — header, claims and expiry — without sending it anywhere.

Header 
 
 
 
 Payload  
 
 
 
  
 
Signature (hex)
 
–
 
  
 
 
 
 
 
About this tool
 
Decode a JWT and read what is inside it: the header (which algorithm signed it), the payload (the claims), and the signature bytes — all decoded in your browser, the token never sent anywhere.
The standard claims are explained in plain language: exp says whether the token is currently valid and until when, iss names who issued it, sub what it is about. Custom claims are shown as they are, without invented meanings.
This tool decodes; it does not verify. A signature check needs the secret or public key — something a paste-it-into-a-page tool must never ask for. Anyone can put anything in an unverified token; the content is only trustworthy once your backend has checked the signature.
 
How to use it
 
     
  1. Paste the token — a Bearer prefix is stripped automatically.
  2. Read the header and payload, pretty-printed, with the claims explained below.
  3. Check the expiry note before trusting anything else: an expired token says so in the claims list.
    4.  
 
Worked example
 
A token with exp set to an hour from now shows the payload on the right and a claims list underneath saying the token is valid until a stated time — about 1 hour from now. The same token tomorrow says it expired, with when.
  
One token, read plainly
 
 
 
 
 
 
Frequently asked questions
 
 
 Why does it not verify the signature? 
Verification needs the signing secret or public key. A page that asks for a secret is asking you to hand over the thing that mints valid tokens — so this tool never asks, and never pretends a signature it has not checked is good.
 
 Is decoding a JWT safe? 
A JWT payload is only base64url-encoded, not encrypted — anyone holding the token can read it. Decoding reveals nothing the bearer does not already have; the security of a JWT rests entirely on the signature, which is your backend's job to check.
 
 What do exp, iat and nbf mean? 
exp: expiry — the token stops being valid at this time, shown in the claims list as a date and how far away it is. iat: issued-at. nbf: not-before — a token dated for the future is not valid yet. All three are seconds since the Unix epoch, as the specification defines.
 
 The signature is shown as hex. Why? 
The signature part of a JWT is raw bytes with no JSON inside. Showing them as hex makes the length and shape visible — you can see an HS256 signature is 64 hex chars, an empty one means alg: none — without pretending to interpret them.
 
 Is my token uploaded anywhere? 
No. A bearer token is a credential; it stays in the tab. This is the one tool on the site where the never-upload promise is not a nice-to-have but the entire point.
 
 
 
 
 
 
 
Related tools