JWT Decoder
Decode a JSON Web Token and read its claims
🔒 100% бесплатно · без регистрации · файлы не покидают ваше устройство
A JSON Web Token looks like one long random string, but it is really three base64url segments separated by dots: a header describing the signing algorithm, a payload holding the claims, and a signature. Only the signature is cryptographic — the header and payload are plain readable JSON to anyone who copies the token. That is exactly why debugging an auth problem usually comes down to looking inside the payload instead of guessing.
This JWT decoder splits the token, decodes both segments and pretty-prints them, then pulls the registered claims (iss, sub, aud, exp, iat, nbf, jti) into a table with human-readable times, so 1767225600 becomes a real date plus 'expired 3 hours ago'. It answers the two questions that come up most often during a failing login: which identity does this token actually describe, and is it still inside its validity window? Everything happens locally in your browser, and the signature is never verified — that check belongs on your server, where the key lives.
Зачем нужен JWT Decoder
Debugging a sudden 401 response
Decode the token your client is sending and check exp against the current time — an expired access token is the most common cause of a surprise 401.
Confirming which user or tenant a token represents
The sub and custom claims show exactly whose session you are looking at, which settles arguments about whether the frontend sent the right token.
Checking scopes and roles during an API integration
When an endpoint returns 403, decoding the payload reveals whether the scope, role or permission claim your backend expects is really present.
Reviewing token configuration before shipping
Inspect alg, iss and aud on a freshly issued token to confirm your identity provider is configured with the values your API validates against.
Полезные советы
- You can paste the whole Authorization header — a leading 'Bearer ' prefix is stripped automatically before decoding.
- Never put a JWT with real user data into a random online decoder that sends it to a server; this one decodes locally, and you can confirm it offline with devtools.
- If a token shows as valid here but your API rejects it, compare clocks: a device that is a few minutes fast makes nbf-protected tokens fail server side.
- exp, iat and nbf are counted in seconds, not milliseconds — a token that appears to expire in the year 56000 usually means someone passed Date.now() without dividing by 1000.
- A token that decodes cleanly still proves nothing about authenticity; treat the payload as untrusted input until your server has verified the signature.
Как пользоваться: JWT Decoder
- 1Paste your JSON Web Token into the input box
- 2Read the decoded header and payload JSON
- 3Check the registered claims table and expiry status
- 4Copy any section you need for your bug report
Часто задаваемые вопросы
Does this tool verify the signature?▾
No. It only decodes the header and payload. Verifying a signature needs the issuer's secret or public key, which should stay on your server.
Is my token sent anywhere?▾
No. Decoding runs entirely in your browser with JavaScript, so the token never leaves your device and nothing is logged.
Why does my token show as expired?▾
The exp claim holds a Unix timestamp. If that moment is already in the past according to your device clock, the token is treated as expired.