BYTETOOLS

JWT Decoder

Decode JWT header and payload instantly, with human-readable iat/exp/nbf timestamps and an expiry badge. Client-side only — tokens never leave your browser.

What is the JWT Decoder?

The ByteTools JWT Decoder splits a JSON Web Token into its three parts and pretty-prints the header and payload as formatted JSON.

  • Instant decode of header and payload to formatted JSON
  • Human-readable iat, exp and nbf timestamps
  • Expired / valid badge based on exp and nbf claims
  • Raw signature segment displayed for reference
  • 100% client-side — safe for production tokens
  • Clear errors for malformed or truncated tokens

How to use the JWT Decoder

  1. 1

    Paste the full JWT (header.payload.signature) into the input box.

  2. 2

    Read the decoded header and payload as pretty-printed JSON.

  3. 3

    Check the expiry badge and the human-readable iat/exp/nbf timestamps.

  4. 4

    Copy the decoded JSON with the copy buttons if you need it elsewhere.

About the JWT Decoder

The ByteTools JWT Decoder splits a JSON Web Token into its three parts and pretty-prints the header and payload as formatted JSON. Registered claims like iat (issued at), exp (expiry) and nbf (not before) are additionally shown as human-readable dates, with a badge telling you at a glance whether the token is still valid or already expired.

It is built for debugging authentication flows: paste a token from your browser's dev tools, an Authorization header or a log line, and immediately see the algorithm, issuer, subject, scopes and custom claims without writing any code.

Decoding happens 100% in your browser — the token is never sent to any server, so it is safe to inspect production tokens. Note that this tool decodes only; it does not and cannot verify the signature without your secret or public key.

Frequently asked questions

Does this tool verify the JWT signature?

No. It only Base64-decodes the header and payload, which requires no secret. Verifying the signature needs the signing key (an HMAC secret or the issuer's public key) and should be done server-side. Never trust a token's claims just because they decode successfully.

Is it safe to paste a real JWT into an online decoder?

With this tool, yes — decoding runs entirely in your browser and the token is never transmitted or logged. Be cautious with decoders that send tokens to a server, because a live token is a bearer credential that grants access to whoever holds it.

What do iat, exp and nbf mean in a JWT?

They are Unix timestamps in seconds: iat is when the token was issued, exp is when it expires, and nbf is the earliest moment it may be used. This decoder converts all three to readable dates and compares exp against the current time to show whether the token is expired.

Why does my JWT fail to decode?

A valid JWT has exactly three dot-separated base64url segments. Failures usually mean the token was truncated when copying, contains extra whitespace or quotes, or is actually an opaque (non-JWT) session token. Check that it starts with something like 'eyJ'.

What is the 'alg' field in the JWT header?

It declares the signature algorithm, such as HS256 (HMAC-SHA256) or RS256 (RSA-SHA256). Servers must whitelist expected algorithms — historically, accepting 'none' or confusing RS256 with HS256 led to serious authentication bypass vulnerabilities.

Are JWTs encrypted?

Standard signed JWTs (JWS) are not encrypted — anyone can read the payload, as this tool demonstrates. Only integrity is protected by the signature. Never put passwords or secrets in a JWT payload; if confidentiality is needed, encrypted JWE tokens are used instead.

Guides for JWT Decoder

Related tools