JWT Decoder — Inspect JSON Web Tokens

What it is

A JWT (JSON Web Token) carries claims such as who a user is. It has three dot-separated parts: header, payload and signature. The first two are base64url-encoded JSON, so anyone can read them. This tool unpacks the token and shows the content neatly, but it does not check the signature.

How to use

1. Paste the token into the input. A leading Bearer and any line breaks are ignored.
2. The header and payload appear as indented JSON, each with its own copy button.
3. If the payload has exp, iat or nbf, they are shown as readable dates with the time left or passed (“in 3 hours”, “2 days ago”), and the expiry status is noted.
4. If the token is malformed, the error tells you which part is wrong. A five-part encrypted token (JWE) is reported as unreadable without its key.

How it works

• Structure follows RFC 7519 (JWT) and RFC 7515 (JWS): exactly three parts separated by dots.
• Each part is decoded from base64url as in RFC 4648 (- and _, padding optional) and read as UTF-8.
• The header and payload must be JSON objects; an array or a string is reported as an error.
• exp, iat and nbf are interpreted as seconds only when they are numbers, then shown in your locale’s format and in ISO 8601 (UTC).
• The expiry status only compares the current time with exp and nbf. The signature is not verified, so tokens with alg none or a wrong signature decode just the same.

Examples

Part	Content
Token start	eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9
header	{"alg": "HS256", "typ": "JWT"}
payload	{"sub": "1234567890", "name": "John Doe", "iat": 1516239022}
iat	2018-01-18T01:30:22Z

That token is the usual practice sample found in JWT introductions. A token whose payload contains {"name": "홍길동"} also decodes without garbling.