JWT decoder
Paste a JWT to read its header, payload and expiry. Decode only, free, and nothing leaves your device.
The decoded header and payload will appear here.Related tools
Base64 encode/decode
Encode text to Base64 or decode Base64 back to text, instantly.
Format JSON
Format, validate, and minify JSON with your choice of indent. Errors show where the problem is. Nothing is uploaded.
Convert timestamp
Convert Unix timestamps to human-readable dates and back, with local/UTC/ISO 8601 output.
Everything you need to read a JWT
Instant decoding
Header and payload decode live as you paste, with no button to click.
Readable expiry
exp, iat and nbf are shown as dates, plus whether the token has expired.
Formatted JSON
Header and payload are pretty-printed so nested claims are easy to scan.
Forgiving input
Paste a bare token, a Bearer value, or a whole Authorization header.
100% private
Runs entirely in your browser. Your token is never uploaded or stored.
Copy or download
Copy the decoded JSON or save it as a .json file.
Decode a JWT in three steps
- 1
Paste your JWT
Paste the token into the box. A leading "Bearer " or a full Authorization header is fine, it is stripped for you.
- 2
Read the header and payload
The decoded header and payload appear instantly as formatted JSON, with the issued, not-before and expiry times in plain dates.
- 3
Copy or download
Copy the decoded JSON to your clipboard or download it as a .json file.
Built for developers debugging auth
JWTs carry login and API access claims in a readable form. PixelTools decodes one instantly so you can check its claims and expiry, with no upload and no account needed.
Debugging auth errors
Check whether a token has expired or carries the scopes and audience your API expects.
Inspecting API responses
See which claims an identity provider such as Auth0, Okta or Firebase actually put in a token.
Testing integrations
Confirm the user ID and roles in a token during local development without writing a script.
Learning how JWTs work
See that a JWT is just readable JSON, which is why secrets don't belong in it.
Frequently asked questions
What is a JWT?
+
A JSON Web Token is a compact string with three dot-separated parts: a header (the signing algorithm), a payload (claims such as the user ID and expiry), and a signature. The header and payload are just Base64URL-encoded JSON, so anyone can read them.
Does this verify the signature?
+
No. This is a decoder only. Checking a signature needs the issuer's secret or public key, and this tool never asks for one. A decoded token is not proof the token is genuine, so always verify it on your server.
Is it safe to paste a real token here?
+
Decoding runs entirely in your browser and nothing is uploaded. Still, treat live tokens like passwords: prefer expired or test tokens when you can, and never share a live one.
Is a JWT encrypted?
+
A standard signed JWT (JWS) is not encrypted. Its contents are readable by anyone who holds it, so never put secrets in the payload. Encrypted tokens (JWE) have five parts and cannot be read without the key.
What do exp, iat and nbf mean?
+
They are Unix timestamps in seconds. exp is when the token expires, iat is when it was issued, and nbf is the time before which it must not be accepted. This tool converts them to readable dates and tells you whether the token has expired.
Why does my token fail to decode?
+
A JWT must have exactly three parts separated by dots, and the first two must be valid Base64URL JSON. A truncated copy, extra characters, or an encrypted five-part token will fail.
Try the JWT decoder now
Free, no account needed.