Security & network

JWT decoder: header, payload and expiry claims

Decode a three-part JWT locally and inspect its header, payload and UTC time claims. Understand why decoding does not verify a token’s signature.

Loading local tool…

How to use

This decodes three-part JWTs without verifying signatures. Valid time claims do not prove authenticity. Never use decoded output alone for authentication.

Your input stays yours

Step by step

Paste the complete three-part token without a Bearer prefix.
Choose Decode to inspect the header, payload and time claims.
Use the timestamp tool for dates; trust must be verified by the actual authentication system.

Educational payload example

{"sub":"demo","iat":1788768000,"exp":1788771600}

Load the tool’s built-in example for a complete token. This shows only a payload shape; iat and exp use seconds. It is not a usable login credential.

Frequently asked questions

Does successful decoding mean a token is valid?

No. This reads data without validating the signature, issuer, audience or permissions. An attacker can construct decodable content; do not use displayed claims for authentication.

Does it support encrypted JWTs?

It handles the three-part form and does not decrypt five-part JWE. A malformed or truncated token is not valid data.

Is exp in seconds or milliseconds?

JWT NumericDate uses Unix seconds. Numeric iat, nbf and exp values are converted to UTC dates; other types are not automatically treated as time values.