Developer
JWT Decoder
Paste a JSON Web Token to read its header, its claims, and when it expires.
Paste a JSON Web Token to read its header and claims, and see at a glance whether it has expired. Your token never leaves this page.
How to use this tool
Paste a JWT, with or without the Bearer prefix, drop or Import a file, or press Sample.
Read the decoded header and payload, the algorithm, the common claims and whether the token has expired or is not yet valid, with dates in plain form.
Copy result or Download the decoded data for debugging. This tool only decodes: it does not check the signature, so it cannot show that a token is genuine, and the token never leaves your browser.
How to use this tool
Paste a JWT, with or without the Bearer prefix, drop or Import a file, or press Sample.
Read the decoded header and payload, the algorithm, the common claims and whether the token has expired or is not yet valid, with dates in plain form.
Copy result or Download the decoded data for debugging. This tool only decodes: it does not check the signature, so it cannot show that a token is genuine, and the token never leaves your browser.
Was this tool helpful?
Suggest an improvementHelp keep ConduitTools free
Every tool here is free, private and built by a solo developer. If this one saved you time, a small tip keeps the site running and new tools coming.
See inside a token without sending it anywhere.
A JWT is three Base64URL parts joined by dots. The first two are plain JSON, so anyone can read them, which is what makes debugging authentication problems possible.
- Header and payload
- The algorithm, key ID, subject, issuer, audience, and every custom claim are shown as formatted JSON you can copy or download.
- Readable dates
- The iat, nbf, and exp claims are converted to real dates, with a plain statement such as Expires in 2 hours or Expired 3 days ago.
- Honest about trust
- Decoding is not verification. This tool shows what a token says, not whether it is genuine, and warns about unsigned tokens.
Frequently asked questions
Does this verify the signature?
No. Verifying needs the secret or public key, and this tool never asks for one. Decoding only reveals the contents, which are readable by anyone who has the token.
Is it safe to paste a real token here?
The token is decoded in your browser and is not uploaded. Even so, treat a live token like a password: prefer expired or test tokens, and never share one publicly.
What do iat, nbf, and exp mean?
iat is when the token was issued, nbf is the earliest time it is valid, and exp is when it expires. They are counted in seconds since 1 January 1970 UTC.
Why can't it read my token?
A JWT has exactly three dot-separated parts. Five parts means an encrypted token (JWE), which cannot be read without its key, and anything else is probably not a JWT.