JWT Decoder

Decode JSON Web Token headers and payloads locally in your browser, then inspect expiration and validity timing claims.

0 characters

Paste a JWT and decode it locally. Signature verification is not performed.

Header


                            


                            

                                

                                    
Payload

                                    
                                

                                

                            

                        

                    


                    
                

            

        


        

            

                

                    

                        
Local developer debugging

                        
Inspect API tokens, session fixtures and OAuth samples without using an upload endpoint.

                    

                    

                        
Readable claims

                        
Pretty printed JSON makes issuer, subject, audience, scopes and custom claims easier to review.

                    

                    

                        
Timing checks

                        
Quickly see whether exp, nbf and iat are in the past, current or future using your device clock.

                    

                

            

        


        

            
Frequently Asked Questions

            

                

                    Is my JWT uploaded when I decode it?
                    
No. The token is decoded with JavaScript in your browser. It is not sent to Convertr servers.

                

                

                    Does this tool verify JWT signatures?
                    
No. This MVP decodes the header and payload only. Signature verification is intentionally not included until key handling and trust UX are approved.

                

                

                    What timing claims does the decoder show?
                    
The tool highlights exp, nbf and iat when those claims are present, with UTC time, local time and relative status.

                

            

        


        

            

                
Related developer tools

                

                    
                        Password Generator
                        Create secure random passwords
                    
                    
                        Hash Generator
                        Generate SHA checksums
                    
                    
                        URL Encoder & Decoder
                        Encode and decode URL text
                    
                

            

        

    

                


                                                    

    

        

            JWT Decoder
        

        

            Decode JWT header and payload segments for inspection without treating the token as verified.
        


        

            

                
Input

                
A JSON Web Token string.

            

            

                
Output

                
Decoded header, payload, and time-claim summaries.

            

            

                
Real limitations

                
Decoding does not verify the signature, issuer, audience, revocation, or trustworthiness; never treat decoded claims as authenticated.

            

            

                
Privacy and data handling

                
a JSON Web Token string is processed in this browser tab. Convertr does not receive or store it; closing or reloading the page clears the working state unless the tool explicitly offers a local download.

            

        


        

            

                
How to use this tool

                
    
                                            
  1. Provide a JSON Web Token string in the tool controls.
    2. 
                                            
  2. Choose the settings that affect decoded header, payload, and time-claim summaries, then run the tool.
    3. 
                                            
  3. Review decoded header, payload, and time-claim summaries before copying or downloading it.
    4. 
                                    

            

            

                
Common failure modes

                
Malformed Base64URL, invalid JSON, missing segments, or an encrypted JWE token cannot be decoded as a signed JWT.

            

        


        

            
Useful example

            
Paste a non-secret test token to inspect its alg, sub, iat, and exp claims while keeping verification separate.