Is the signature verified?

No. Decoding is not authentication. Treat the payload as untrusted.

Are times local or UTC?

UTC ISO strings. They are not converted to your timezone.

Why is my token invalid?

Wrong number of segments, bad base64url, or a header or payload that is not JSON. Five parts is JWE, which this decoder does not open.

What about encrypted JWE?

Rejected. This decoder is for compact JWS (three parts) only.

Can I sign a token here?

No. No signing keys are used. We only read.

JWT Decoder

Loading tool…

About JWT Decoder

Paste a compact JWT or upload a .txt or .jwt file, then read Header, Payload, and Signature (unverified). A compact token has three base64url parts separated by dots. Invalid JSON in a part is a decode error. Copy sits on the header JSON and the payload JSON. The signature has no copy button.

This is not authentication. Anyone can decode a JWT. Treat claims as untrusted. Encrypted JWE (five parts) is rejected. We do not check alg, kid, or any signing key.

How to use JWT Decoder

1Paste the token or upload a file. Three base64url parts separated by dots. Upload accepts .txt and .jwt, 15MB max.
2Read header and payload. Invalid JSON in a part is shown as a decode error. Copy the pretty-printed JSON if you need it.
3Check Expired and Not valid yet. Those badges compare exp and nbf to now. The token is still unverified.
4Treat claims as untrusted. Do not use this page as login or as proof the token is valid.

Claims and times

The claims table lists iss, sub, aud, exp, nbf, iat, and jti when those keys exist. exp, nbf, and iat show as UTC ISO timestamps. Unix seconds and millisecond values are both accepted for display. Expired appears when exp is a number in the past. Not valid yet (nbf) appears when nbf is in the future. iat is shown and is not flagged.

An empty signature is labeled (empty). Upload is capped at 15MB. Paste is not size-capped.

Limits and privacy

Decoding runs in your browser. The token is not uploaded. No account. Closing the page drops the paste. Signatures are never verified here.

FAQs

Is the signature verified?: No. Decoding is not authentication. Treat the payload as untrusted.
Are times local or UTC?: UTC ISO strings. They are not converted to your timezone.
Why is my token invalid?: Wrong number of segments, bad base64url, or a header or payload that is not JSON. Five parts is JWE, which this decoder does not open.
What about encrypted JWE?: Rejected. This decoder is for compact JWS (three parts) only.
Can I sign a token here?: No. No signing keys are used. We only read.