Inspect a JSON Web Token without sending it anywhere
A JWT carries its own claims in readable base64. This decoder shows you the header and the payload side by side, flags the standard claims, and tells you whether the token has expired — all without transmitting the token to a server.
- Verifies signature
- No, by design
- Claims
- Standard set flagged
- Transmission
- None
How to use it
- Paste the token A full token looks like header.payload.signature. The decoder also accepts a token with the Bearer prefix still attached.
- Read the decoded parts The header and payload are decoded and pretty-printed, with the standard claims such as exp, iss, aud and nbf highlighted and translated.
- Check the lifetime The expiry is shown in both UTC and local time with a remaining-lifetime countdown, and expired tokens are labelled clearly.
Reference
Registered claims the decoder flags
| Claim | Meaning | Type |
|---|---|---|
| `iss` | Issuer | String |
| `sub` | Subject — usually a user id | String |
| `aud` | Audience — who the token is for | String or array |
| `exp` | Expiry time | Numeric date |
| `nbf` | Not valid before | Numeric date |
| `iat` | Issued at | Numeric date |
| `jti` | Unique token id | String |
Questions people ask
Does this tool verify the signature?
No. Verifying requires the issuer’s public key, and uploading a key to a third party to check a token would be worse than not checking it at all. The token is decoded and inspected only.
Why does my token fail to decode?
Most often it is a copy-paste artefact: a trailing newline, a truncated token, or a segment that was URL-encoded. Another common cause is a JWE, which has five segments instead of three — this decoder handles the signed form.
What does the payload of a JWT contain?
Whatever the issuer put there. Standard claims like sub, iss and exp are optional, and many services add their own — role, permissions, tenant id, an email address. Because the payload is only encoded, treat everything in it as readable by anyone holding the token.
Is the token secret?
Yes. Anyone with a copy of it can act as the user until it expires, and until it expires is often an hour or more. That is why a token should be treated exactly like a password and never pasted into a shared site.
What is the difference between a JWT and a session cookie?
A JWT is self-contained: it carries its own claims and the server verifies it without a lookup. A session cookie is an opaque key into server-side state. JWTs are simpler to scale horizontally, but they cannot be revoked before expiry, which is the usual reason to choose sessions for sensitive operations.
Can I decode a JWT that has expired?
Yes, and it is worth doing. Expired tokens still decode, and seeing the exp claim confirms whether the expiry is the actual cause of the failure.
Details that catch people out
Anyone can create a token with any claims they like, because the payload is only base64-encoded, not encrypted. A real check requires verifying the signature with the issuer’s public key. This tool explicitly does not do that, because verifying requires a key you would have to hand to a server.
JWT segments use the URL-safe base64 alphabet with the padding stripped. A decoder built for standard base64 will often reject a perfectly valid token, which is the usual reason a “broken” token fails to decode.
Where this earns its keep
Finding out why a request is rejected
A 401 from an API is often a token that has expired, is signed for a different audience, or was issued by a staging issuer. The decoded claims make that visible in seconds.
Checking what a third-party integration stores
Before connecting an OAuth provider, decode the token to see exactly which scopes and claims you are agreeing to hand over.
Debugging a session that keeps dropping
If exp is close to the present time, the session lifetime is the problem, not your code. The countdown shows it immediately.
Guides that go deeper
- How to Read a JSON Web Token (JWT) 6 min read · A practical guide to reading a JSON Web Token: what the header and payload contain, why the…
- Base64 Is Not Encryption 6 min read · What Base64 actually does, why it is not a security measure, when it is the right tool, and…
- How Webhook Signature Verification Works 8 min read · How to verify that a webhook really came from the provider: HMAC signatures, the raw body…
Last reviewed 2026-10-11. Every tool on DevSnap runs entirely in your browser, so whatever you paste here never reaches a server.