JWT Decoder
A token is three Base64url segments separated by dots, and the useful thing to say about one is what it claims and when it expires. The dangerous thing is to imply more: reading a token proves nothing about whether it is genuine, because the signature can only be checked with a key. A decoder that says "valid" when it means "well-formed" is actively misleading, so that word does not appear here.
What this generator does
Splits the token, decodes the first two parts from Base64url into JSON, explains the registered claims, and turns the timestamps into dates you can read.
How to use this tool
- Paste the token — it stays in your browser.
- Read the header and the claims.
- The standard claims are explained, and the timestamps written out as dates.
- Remember that nothing here checks the signature.
Understanding the controls
- Your token
- The whole token, three parts separated by dots. It is decoded in your browser and never sent anywhere — which matters, because a token is a credential.
Common use cases
- Seeing what claims a token actually carries
- Checking when a token expires, and whether it already has
- Working out which algorithm signed a token
- Debugging an authentication problem
- Understanding the shape of a token from an unfamiliar service
How this generator works
The decoding is checked for faithfulness rather than for authenticity: each segment is turned back into Base64url and must reproduce exactly the characters that were in the token. That catches a padding mistake or a mangled character, which are the ways a decoder actually goes wrong. The signature is reported by length and explicitly not checked, because checking it needs a key.
Randomness and fairness
Nothing is random. The same token always reads the same way.
For how randomness is produced across the whole site, see how Generate Random works.
Limitations and good to know
- The signature is not verified, and cannot be without the key. A token that reads correctly may be entirely forged.
- Encrypted tokens, where the payload is not readable at all, are a different format and will not decode here.
- Expiry is judged against your device's clock, which may be wrong.
- A token is a credential. Pasting one anywhere is a risk; here it stays in the browser, but that is worth knowing in general.
Privacy and your data
The token is decoded entirely in your browser and is never transmitted or stored, which matters because a token is a credential.
Related generators
- Text Encoder and DecoderEncodes text as Base64, percent-encoding, HTML entities, hex or binary, and back again — accents and emoji included.
- JWT Sample GeneratorGenerate a clearly-fake JWT-shaped sample string — not a valid or usable authentication token.
- Checksum and Hash CalculatorWorks out SHA-256, CRC-32, Adler-32 or FNV-1a for any text, checked against the published values.
- JSON Formatter and ValidatorTidies or minifies JSON, says exactly where an invalid document goes wrong, and proves the data still says the same thing.