JWT Decoder — Read Header & Payload Locally (No Verify)
Paste a JWT to read its header and payload JSON in your browser — no signature verification. Steps: paste the token, decode, then copy header or payload. Example: the sample token shows alg HS256 and iat 1516239022 with UTC and local time. Tokens are not uploaded.
How it works
Paste a complete JWT string (header.payload.signature). The page splits on dots, Base64url-decodes the first two segments, and pretty-prints JSON. exp, iat, and nbf numeric claims also show UTC and local times. The signature segment is shown as raw text only — we never verify it.
Rules you should expect
What this decoder does and does not do: structure, Base64url steps, registered claims, and the no-verify boundary.
- Structure: a signed JWT (JWS compact form) has three Base64url segments — header (alg, typ), payload (claims), signature (bytes, not JSON).
- Base64url decode: replace -→+, _→/, pad to length % 4, then atob and JSON.parse. Malformed segments fail with a specific header/payload error.
- Registered claims: exp (expiry), iat (issued at), nbf (not before) are numeric Unix seconds in UTC. Decoding them does not prove the token is trustworthy.
- Privacy & limits: paste stays local; no HMAC/RSA verification. Do not use decoded JSON alone to grant access in production.
Example
Input: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9eIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c → Header: {"alg":"HS256","typ":"JWT"}. Payload: {"sub":"1234567890","name":"John Doe","iat":1516239022} with iat shown in UTC and local time. Signature is shown raw — not verified.
Good fits
- Full-stack debugging: inspect OAuth access token sub, scope, and exp before wiring an API gateway rule.
- API contracts: confirm iss and aud in an ID token match your service documentation.
- Learning: see how header alg/typ and payload claims map to the three JWS segments.
Frequently asked questions
Does this page verify the JWT signature?
No. Decoding only reverses Base64url on the header and payload. Anyone can read those parts; signature verification needs the issuer secret or public key and is intentionally not implemented here.
Why does my token fail with a segment error?
Check that you pasted the full token with two dots separating three segments. Extra dots, truncated paste, or non-JWS strings (plain Base64 blobs) will fail.
How is JWT Base64url different from normal Base64?
JWT uses Base64url: - instead of +, _ instead of /, and padding = is often omitted. Standard Base64 tools may mishandle URL-safe tokens — use this page or our Base64 tool with url-safe mode.
How do I read exp, iat, or nbf?
exp, iat, and nbf are Unix seconds (UTC). This page converts them to readable UTC and your local timezone. Compare exp to now for expiry; pair with our Unix Timestamp tool for other formats.
Is my token uploaded to a server?
No. Splitting, Base64url decode, and JSON parsing run entirely in your browser tab. Do not paste production secrets on shared machines.
Related tools
Questions or feedback
Something unclear, broken, or missing? Draft a message below — we read every note about these tools.