A JWT decoder that reads two thirds of the token
Paste the token, read the claims. The JWT decoder splits the string at the dots, turns the first two parts from Base64URL back into text and prints them as indented JSON. It never opens the third part, the signature.
- Paste the token into "Encoded JWT token". The field starts with a built-in sample: an HS256 token for a user named Max Mustermann with the roles admin and user. "Load sample" brings it back, "Clear" empties the field.
- Find the algorithm and the token type in the header panel on the left.
- Find the claims in the payload panel on the right. Both panels update on every keystroke.
- Look at the status bar above the panels. It says whether the exp date has passed (the signature is not checked), and it shows the expiry date in the format of your language.
- Press the copy button of a panel to put its formatted JSON on the clipboard.
Why a green status proves less than it looks
The tool does not verify the signature. It has no key field, and the code never reads the third part. The green status means one thing: the exp claim lies in the future on your device clock. Change the clock and the answer changes. A forged token with a good exp looks exactly the same. To check a signature you need the secret or the public key, and a JWT library on your server.
Claims that are skipped, inputs that fail
Only exp is tested. The claims nbf and iat show up as raw numbers in seconds since 1970. Without exp, the tool prints "No end date (signature not checked)".
A leading Bearer is not removed, so the decoding fails with a Base64 error. Encrypted tokens (JWE, five parts) fail as well, because their payload is not JSON. A token with only two parts still decodes, since the tool needs just the header and the payload.
Two minutes into a 401
- Your API answers 401 and you suspect an old access token. Paste it. If the bar says expired, the date shows how long ago it ran out.
- A new identity provider: does the
rolesarray hold what you expect? - A mobile app sends a token to the wrong backend. Compare the
subandexpvalues with the token you meant to send.
What the page does with your token
Decoding runs in JavaScript on your device. Typing or pasting sends no request, and the Network panel of your developer tools will confirm it. The tool does not store the token. The clipboard is touched only when you press a copy button.