Developer Tools
JWT decoder
Decode a Base64URL JWT header and payload and inspect its dates. Local processing does not verify its signature or prove authenticity.
Decoding does not verify the signature, authenticity or cryptographic validity. Do not paste live tokens on an untrusted device. Maximum 16 KiB.
What this tool does
Inspect claims such as iss, sub, aud, iat, nbf and exp while testing an integration. Reading the contents does not authorize access or replace server-side cryptographic verification.
How to use it
- Paste a synthetic three-part compact JWT.
- Select Decode and inspect the header, payload and available UTC dates.
- Copy the JSON if needed, then reset to clear the contents.
Verifiable example
- Input
- A payload containing exp: 0.
- Expected result
- exp date: 1970-01-01T00:00:00.000Z; signature not verified.
Limitations to review
- Maximum 16 KiB; valid object JSON and UTF-8 required. Five-part JWE is unsupported.
- Does not validate signatures, algorithms, audiences or expiration for authorization. Avoid live tokens on untrusted devices.
Related tools
Browse all guides. Local processing: the page downloads HTTP resources but does not send files or input data to a server for these functions.