JWT Decoder
Runs in your browserDecode a JSON Web Token to read its header, payload and expiry. Does not verify signatures.
This tool decodes JWT tokens. It does not verify signatures. Anyone can create a token containing any claims they like. What you see below is what the token says, not proof that it is genuine. Verification requires the signing key and must happen on the server that holds it.
Token
Paste a token
The header, payload and timing claims appear here. Nothing is transmitted — decoding happens in this tab.
Your data never leaves your device
This tool runs entirely in your browser. Nothing you enter is uploaded, stored or logged by BeeTools.
How to use the jwt decoder
Paste the token
Paste the whole three-part string. A leading "Bearer " prefix copied from an Authorization header is stripped automatically.
Read the status first
The badge tells you whether the token is inside its lifetime, expired, or not yet valid — usually the reason you opened the tool.
Inspect the payload
The claims are shown as formatted JSON. Registered claims are annotated beneath so you can tell iss from aud without looking them up.
Check the timing claims
iat, exp and nbf are shown both as readable UTC dates and as their raw Unix values, which is what you need when comparing against a log.
Remember what this does not prove
A decoded payload only tells you what the token says. Whether it is authentic can only be established by verifying the signature with the key, on the server.
Features
Header and payload, formatted
Both segments decoded and pretty-printed as JSON, each independently copyable.
Timing claims in plain English
iat, exp and nbf converted from Unix seconds to readable dates, with the current status.
Honest about what it does not do
States clearly that signatures are not verified, rather than implying a token is genuine.
Flags unsigned tokens
A token declaring alg "none" carries no signature at all — that is called out prominently.
Claims explained
Registered claims such as iss, sub, aud and jti are annotated with what they mean.
Safe for production tokens
Decoding runs in this tab. Your token is never transmitted, so inspecting a live one is safe.
About this tool
A JSON Web Token is three base64url-encoded parts joined by dots: a header saying how it was signed, a payload carrying the claims, and a signature over the first two. The first two parts are only encoded, not encrypted, which means anyone holding a token can read everything in it. That is worth internalising — a JWT payload is not a private place to put data.
This tool decodes those parts and lays them out: the header, the payload as formatted JSON, and the timing claims translated from Unix seconds into readable dates with a plain statement of whether the token is currently within its lifetime. Registered claims like iss, sub and aud are annotated so you do not have to remember what each abbreviation means.
It deliberately does not verify signatures, and it never will. Verification requires the signing key. A browser tool that asked you to paste your secret in order to check a token would be teaching a genuinely dangerous habit, and one that showed a green tick without the key would simply be lying. Decoding tells you what a token claims; only the server holding the key can tell you whether those claims are true. Anyone can mint a token asserting they are an administrator — that is precisely why signature verification exists and why it belongs on the server.
Tokens are credentials, so decoding happens entirely in your browser. Nothing you paste is transmitted, logged or stored, which is the difference between safely inspecting a production token and leaking one.
- Header and payload, formatted. Both segments decoded and pretty-printed as JSON, each independently copyable.
- Timing claims in plain English. iat, exp and nbf converted from Unix seconds to readable dates, with the current status.
- Honest about what it does not do. States clearly that signatures are not verified, rather than implying a token is genuine.
- Flags unsigned tokens. A token declaring alg "none" carries no signature at all — that is called out prominently.
- Claims explained. Registered claims such as iss, sub, aud and jti are annotated with what they mean.
- Safe for production tokens. Decoding runs in this tab. Your token is never transmitted, so inspecting a live one is safe.
Frequently asked questions
Does this tool verify the signature?
No, deliberately. Verification requires the signing key, and a browser tool asking you to paste a production secret would be teaching a dangerous habit — while one that showed a verification result without the key would be lying. This tool tells you what a token claims. Only the service holding the key can tell you whether those claims are genuine.
Is it safe to paste a real token here?
Yes, and this is the main reason to use this tool rather than most alternatives. Decoding happens in your browser using built-in functions, and nothing is transmitted — you can confirm that in your browser’s network panel. Many online JWT tools post your token to a server, which for a live credential means handing it to a third party.
Is the data in a JWT encrypted?
No. The header and payload are base64url-encoded, which is an encoding, not encryption — anyone with the token can read them, exactly as this page does. The signature protects against modification, not against reading. Never put anything confidential in a JWT payload.
What does "alg: none" mean?
It declares that the token is unsigned. The algorithm was included in the original specification and turned out to be a serious flaw: a server that trusts the header’s algorithm field can be handed a token with the signature stripped and no way to tell. Any library worth using rejects such tokens outright. If you see one in production, treat it as a finding.
Why is my token showing as expired when it just worked?
The exp claim is compared against your device’s clock. If your system time is wrong, or the issuing server’s clock has drifted, the two will disagree. The raw exp value is shown alongside the formatted date precisely so you can compare it with the server’s own timestamp rather than trusting either clock.
What is the difference between exp, nbf and iat?
iat records when the token was issued and is informational. nbf sets the earliest moment the token may be accepted, which is useful for tokens minted ahead of time. exp sets the moment it must stop being accepted. All three are Unix timestamps in seconds — not milliseconds, which is a common source of tokens that appear to expire in 1970.
Can I decode a token that has been truncated?
Only if the header and payload survived intact. A JWT must have exactly three dot-separated parts, and a truncated copy usually loses part of the signature or the tail of the payload, which makes the base64 invalid. The tool reports how many parts it found so you can tell truncation from a malformed token.
Related tools
Tools that pair well with this one.
- Your data never leaves your device
Base64 Encoder & Decoder
Encode text to Base64 or decode it back, with full Unicode support and a URL-safe option.
- Your data never leaves your device
JSON Formatter & Validator
Format, validate and minify JSON in your browser, with the exact line and column of any syntax error.
- Your data never leaves your device
Unix Timestamp Converter
Convert Unix timestamps to dates and back, with the seconds-or-milliseconds question answered.
- Your data never leaves your device
URL Encoder & Decoder
Percent-encode and decode URLs and query parameters, with the right escaping for each.