JWT Decoder
Decode and verify JSON Web Tokens
About the JWT Decoder
A JSON Web Token looks like one long, unreadable string, but it is really three Base64URL-encoded sections — header, payload, and signature — joined by dots. The JWT Decoder splits that string apart and shows you the JSON inside each section in a readable, indented form.
Developers lean on it while debugging authentication: checking which claims an identity provider actually issued, confirming a token has not silently expired, or comparing the payload from a failing request against one that works. Because it decodes any well-formed token, it is just as useful for inspecting access tokens from an OAuth flow as it is for reading a session token pulled from local storage.
One detail worth understanding: decoding is not the same as verifying. This tool reveals what a token contains; it does not check that the signature is authentic, because that requires the issuer's secret or public key.
How to Use the JWT Decoder
- Paste your token into the "JWT Token" field — it should be the full string with two dots separating three parts.
- Click Decode.
- Read the Header section to see the signing algorithm and token type.
- Read the Payload section for the claims; any "exp" (expires) and "iat" (issued at) timestamps are automatically shown in human-readable local time.
- Use the copy button on the header or payload to grab the formatted JSON, and note that the Signature is shown as raw Base64 since it cannot be decoded without the key.
Why Use ToolForge’s JWT Decoder
- Tokens are decoded in your browser with the native atob function — the token never leaves your device, which matters because JWTs often carry session identity.
- Expiry and issued-at timestamps are converted from Unix epoch to readable dates automatically, so you can see at a glance whether a token is stale.
- Header, payload, and signature are shown separately, each with its own copy button, instead of as one undifferentiated blob.
- It is honest about its limits: it shows the signature without pretending to validate it, so you are never misled into trusting an unverified token.
Frequently Asked Questions
Does this tool verify the token's signature?
No. It decodes and displays the contents of all three parts but does not verify the signature, which would require the secret key (for HMAC) or public key (for RSA/ECDSA). Treat the decoded output as informational, not as proof the token is valid.
Is it safe to paste a real access token here?
Decoding happens entirely in your browser and the token is never sent anywhere. That said, anyone with a valid token can use it until it expires, so avoid pasting production tokens into any tool on a shared or untrusted computer as a general precaution.
Why does it say "Invalid JWT format"?
A JWT must have exactly three sections separated by dots. That error means your input has the wrong number of parts — often because a dot is missing, the string was truncated when copied, or you pasted something that is not actually a JWT.
What do "exp" and "iat" mean in the payload?
"iat" is the time the token was issued and "exp" is the time it expires, both stored as Unix timestamps. This decoder converts them to readable dates so you can immediately tell when a token was created and whether it is still valid.
