JWT Decoder Online — Decode JWT Tokens
Decode a JWT token and inspect its header, payload, issued-at (iat) and expiration (exp). Decoding happens locally in your browser — your token is not uploaded.
About JWT Decoder
A JWT (JSON Web Token) is a compact token of three dot-separated parts: header.payload.signature. Header and payload are base64url-encoded JSON, so they can be read without a secret. The signature protects the token from tampering and requires a key to verify. This tool only decodes the visible parts — everything happens in your browser, your token is never uploaded.
When you need a JWT decoder
Debugging authentication
Check what your auth server actually puts in the payload: user id, roles, scopes, claims. Compare iat/exp against server time when requests start returning 401.
Expired token
If your app reports "token expired", paste the JWT and instantly see exp in human-readable form — sometimes it's just the client clock that's wrong.
OAuth / OIDC payloads
When integrating with OAuth2 / OpenID Connect — see which claims your provider actually emits (sub, iss, aud, scope) and whether they match what you expect.
Reading id_token on the frontend
From id_token you often need to extract email, name or roles — the decoder shows the JSON you can later parse in code via atob.
FAQ
Is it safe to paste a JWT into this tool?
Decoding runs in your browser in JavaScript, the token is not sent to convertilo. Still, for production secrets prefer local utilities — public online tools are best avoided for live tokens.
Why isn't the signature verified?
Verifying the signature needs the secret (HS256) or public key (RS256/ES256). The decoder just splits the structure and shows claims — for cryptographic verification use a library (jsonwebtoken, jose, etc.).
Is JWT encryption?
No, a regular JWT (JWS) is signed but NOT encrypted. Anyone holding the token can read the payload. Don't put passwords, card numbers or other secrets inside it.
What do iat, exp, nbf, sub, iss, aud mean?
iat — issued at (unix seconds). exp — expiration. nbf — not before (when it becomes valid). sub — subject (user id). iss — issuer (who minted it). aud — audience (which service it's for).
Can I decode a JWT without the signing key?
Yes — header and payload are public, just base64url-encoded JSON. "Decoding" means base64url-decoding and parsing JSON, which is exactly what this tool does.