JWT Decoder
Decode and inspect a JSON Web Token.
Decoded locally in your browser. This shows the token contents — it does not verify the signature.
About this tool
A JWT is three base64url segments separated by dots: a header naming the algorithm, a payload of claims, and a signature. This splits it and shows the header and payload as readable JSON, including when the token expires.
Decoding happens entirely in your browser and the token is never transmitted — which matters, because pasting a live session token into a remote service hands over whatever it authorises.
Common questions
Is the payload of a JWT encrypted?
No. It is base64url-encoded, which anyone can reverse. The signature stops the contents being altered, not read. Never put anything secret in a JWT payload.
Can this verify the signature?
No — verification requires the signing key, which should never be pasted into a web page. This decodes and inspects claims; validation belongs on your server.
What do exp, iat, and nbf mean?
They are Unix timestamps: iat when the token was issued, exp when it expires, nbf the earliest time it is valid. An expired token is the single most common cause of an unexplained 401.
Turn it into an interactive demo
createademo turns screenshots and recordings into demos your buyers click through themselves. Free plan, full editor, no credit card.