How to decode a JWT
- Paste your token into Encoded token; a leading Bearer prefix is removed automatically.
- See the three parts color-coded, plus status badges for expiry and algorithm.
- Read the pretty-printed header and payload, and the table of time and identity claims.
- Copy the header or payload JSON with the buttons below.
What you can do with JWT Decoder
- Header and payload
- Decodes both Base64URL-encoded parts into formatted JSON so every claim is easy to read.
- Expiry check
- Tells you whether the token is expired or still valid, with relative times like in 59 minutes, and flags tokens that aren't valid yet.
- Readable dates
- Converts exp, iat, nbf and auth_time from Unix timestamps to your local date and time.
- Standard claims
- Lists issuer (iss), subject (sub) and audience (aud) on their own rows, including tokens with multiple audiences.
- Security warnings
- Highlights unsigned tokens with alg: none and recognizes encrypted five-part JWE tokens that can't be decoded without a key.
- Stays on your device
- Decoding is plain JavaScript in your browser, so production tokens aren't exposed to a third-party server.
JWT structure and why decoding is not verification
A JSON Web Token (JWT, RFC 7519) has three parts separated by dots: a header naming the signing algorithm, a payload of claims, and a signature. The header and payload are only Base64URL-encoded, not encrypted, which means anyone holding a token can read its contents. That's why decoding is easy, and why you should never put secrets or sensitive personal data in a JWT payload. Registered claims include exp (expiry), iat (issued at), nbf (not before), iss (issuer), sub (subject) and aud (audience).
Decoding is not verification. This tool doesn't check the signature, so it can't tell you whether a token is genuine. Your server must verify the signature with the correct key and algorithm, reject alg: none, and check exp, nbf, iss and aud before trusting any claim. Decoding is still the fastest way to debug authentication problems: an expired exp, a wrong audience, a missing scope or clock skew between servers explains most unexpected 401 errors.
Frequently asked questions
Is it safe to paste a real JWT into this decoder?
Yes. The token is decoded entirely in your browser and never sent to PanDev or anyone else. Even so, treat live tokens like passwords, since they grant access until they expire. Avoid sharing screenshots, and use expired or test tokens when you can.
Does this tool verify the JWT signature?
No. It only decodes the header and payload. Verifying a signature requires the secret or public key and should happen on your server. A token with valid-looking claims can still be forged, so never trust claims without verification.
How do I check if a JWT is expired?
Paste the token and look at the status badge. It reads the exp claim and shows Expired with how long ago, or Valid with the time remaining. The claims table also shows the exact expiry date in your local time zone.
Why can't my token be decoded?
A JWT needs exactly three dot-separated parts, with valid Base64URL-encoded JSON in the first two. Tokens with five parts are encrypted JWE tokens, which can't be read without the key. Also check that the token wasn't cut off when you copied it.
Can I edit and re-sign a token here?
No. This is a read-only decoder. Changing the payload would invalidate the signature anyway, so creating or re-signing tokens should be done in your application or auth server with your own signing key.