This JWT decoder splits a JSON Web Token into its three parts and shows the header and payload as readable, indented JSON. Time claims such as exp, iat and nbf are converted into local and UTC dates with a relative time, so you can see at a glance when a token was issued and whether it has already expired.
Access tokens and ID tokens often carry user IDs, emails and permissions, so pasting them into a random website is a real risk. Here the token is decoded with plain JavaScript inside your browser tab; it is never sent to a server or stored. You can even paste the whole Authorization: Bearer … value and the prefix is ignored.
How to use the JWT Decoder tool
- Copy a token from your app, browser dev tools or an API response.
- Paste it into the box. A leading Bearer is removed automatically.
- Read the decoded header (algorithm and type) and the payload claims.
- Check the status line to see whether the token is valid now, expired or not yet active.
- Use the Copy buttons to take the formatted header or payload JSON.
Why use ToolOrca JWT Decoder
- Decodes header and payload instantly
- exp, iat and nbf shown as real dates
- Clear expired / not-yet-valid status
- Handles Base64URL and UTF-8 claims
- Warns about unsigned "alg: none" tokens
- Token never leaves your device
How a JWT is built
A JWT is three Base64URL-encoded strings joined by dots: header.payload.signature. The header says which algorithm signed the token (for example HS256 or RS256). The payload holds the claims: registered ones like iss (issuer), sub (subject), aud (audience) and exp (expiry), plus any custom data the issuer adds.
The payload is only encoded, not encrypted. Anyone who has the token can read it, which is exactly what this tool does. Never put passwords or secrets in a JWT payload.
Decoding is not verifying
This decoder does not check the signature. A decoded token can still be forged or tampered with. Your server must always verify the signature with the secret or public key and check exp, nbf, iss and aud before trusting any claim. Use this page for debugging and inspection only.
Frequently asked questions
Is it safe to paste my JWT here?
Yes. The token is decoded locally with JavaScript in your browser. Nothing is uploaded, logged or saved. Still, treat live tokens like passwords and avoid sharing them in screenshots or chats.
Does this tool verify the JWT signature?
No. It only decodes the header and payload. Verifying needs the signing secret or public key and should be done by your server or auth library.
What do exp, iat and nbf mean?
exp is the expiry time, iat is when the token was issued, and nbf means "not before" — the token must not be accepted earlier. All three are Unix timestamps in seconds.
Why does my token fail to decode?
Check that you copied the whole token with both dots and no extra quotes or spaces. If the payload is not JSON, the token is probably an encrypted JWE, which cannot be read without the key.
Can I decode a token from Auth0, Firebase, Cognito or Azure AD?
Yes. Any standard JWT works, including ID tokens and access tokens from these providers, as long as it is a signed JWT (JWS) and not an opaque or encrypted token.