About JWT Decoder
JWT Decoder splits a JSON Web Token into its header, payload, and signature, and shows standard time claims (exp, iat, nbf) as readable dates with the token's current status. Decoding does not verify the signature, and the tool clearly says so.
How to use JWT Decoder
- Paste a JWT (three Base64URL segments separated by dots).
- Review the decoded header and payload.
- Check the expiry status and timestamps shown for exp, iat, and nbf.
Examples
Debugging authentication
Confirm that an access token contains the expected audience (aud) and has not expired before investigating server-side errors.
Limitations
- The signature is not verified. A decoded token is not proof that it is authentic.
- Encrypted tokens (JWE, five segments) cannot be decoded without the key.
Privacy
This tool processes everything locally in your browser tab. Your input is not uploaded to Utilhex or any third party, and it is discarded when you close or reload the page. Read the privacy policy for details.
Frequently asked questions
Is it safe to paste a production token?
Decoding happens entirely in your browser and nothing is sent to Utilhex. Still, treat live tokens as secrets: avoid sharing screenshots and prefer expired or test tokens.
Why isn't the signature verified?
Verification requires the issuer's secret or public key. Decoding without verification is useful for debugging but must never be used to trust a token.