JWT Decoder
Decode a JSON Web Token (JWT) in your browser — split it into header, payload and signature, base64url-decode and pretty-print the header and payload as JSON, and read the registered date claims (iat, nbf, exp) as human-readable UTC times. Inspect only; the signature is never verified and the token never leaves your browser.
Input
Paste a header.payload.signature token. Decoded locally — the token is never uploaded.
Output
The signature is shown as-is. Verifying it requires the signing secret or key and is not done here.
| Claim | Time (UTC) |
|---|---|
| No data yet | |
Guides
A JWT (JSON Web Token) is the compact string your app receives after login or an API handshake — three base64url-encoded parts joined by dots: header.payload.signature. Because it's only encoded, not encrypted, anyone can read what's inside. This decoder splits a token, base64url-decodes the header and payload, pretty-prints each as JSON, and shows the raw signature so you can see exactly which claims a token is carrying.
Paste a token to instantly see who issued it, who it's for, which algorithm signed it, and when it expires — without wiring up a library or hitting a server.
How to use it
- Copy a JWT from your browser's storage, an
Authorization: Bearerheader, a log line, or an API response. - Paste it into the JWT to decode box. Decoding happens as you type.
- Read the Header (algorithm and token type), the Payload (all claims), the raw Signature, and the Registered date claims table, which converts
iat,nbf,expandauth_timefrom Unix seconds to readable UTC times.
What do the parts mean?
The header names the signing algorithm (alg, e.g. HS256, RS256) and token type (typ). The payload holds the claims — registered ones like iss (issuer), sub (subject), aud (audience), exp (expiry), plus any custom claims your system adds. The signature is a keyed hash over the header and payload that proves the token wasn't tampered with.
Does this verify the signature?
No — and that's intentional. Verifying a signature requires the secret (for HMAC algorithms) or the issuer's public key (for RSA/ECDSA), which should never be pasted into a web page. This tool decodes and inspects only. Treat the decoded claims as unverified until your backend has checked the signature against the trusted key. The signature segment is shown so you can copy it for a separate, server-side verification step.
Is a JWT encrypted?
Usually not. A standard signed JWT (a JWS) is only base64url-encoded, so the payload is fully readable by anyone who holds the token. Never put passwords or secrets in a JWT payload. Encrypted tokens (JWE) are a different, five-part format and can't be read without the decryption key.
Why does my token show as expired or not-yet-valid?
Check the date-claims table. exp in the past means the token has expired; nbf in the future means it isn't valid yet. All times are shown in UTC so they're unambiguous across time zones.
Is my token safe here?
Yes. Everything runs entirely in your browser using the built-in base64 and text-decoding APIs — the token is never uploaded, logged, or sent to any server. Since JWTs frequently carry sensitive identity claims, session identifiers, and access scopes, that matters: you can safely decode a real production token, and it never leaves your machine. The shareable-link feature deliberately excludes the token text, so a link you share can't leak it.
Use it from code
From 3 credits per callREST API
curl -X POST https://api.iotools.cloud/v1/tool/jwt-decode \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"jwtToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiI…"
}'Swap in your own key from your account. The tool's fields are the body — no wrapper.
Ask an AI agent
Use the IOTools `jwt-decode` tool (JWT Decoder) on this input:
YOUR_INPUT_HEREPaste this at any agent connected to the IOTools MCP server, then add your input.