SmartKitio

JWT Decoder

Paste a JSON Web Token to read its header (algorithm, key ID) and payload claims (subject, expiry, scopes) as formatted JSON.

Decoding a JWT does not verify its signature. This tool only reads the header and payload.

Input
Output

About this tool

A JWT is three Base64URL-encoded parts separated by dots: header, payload, and signature. This tool decodes the first two and parses them as JSON. It does not check the signature, so a decoded token is not proof that the token is genuine or unexpired. Times such as exp, iat, and nbf are Unix timestamps in seconds; paste them into the Unix Timestamp Converter to read them as dates.

Limits

  • Decoding does not verify the signature, the issuer, or the expiry. A decoded token is not proof that it is genuine.
  • exp, iat, and nbf are Unix timestamps in seconds. This page does not convert them to dates.
  • A live token can grant access. Prefer a test or expired token, and do not paste production tokens into a shared screen.

How to use it

  1. Paste the token, starting with eyJ.
  2. Read the header and payload panels.
  3. Check exp against the current time if you are debugging an expired session.
JSON.parse(base64url(part))

Examples

  • Typical header

    {"alg":"HS256","typ":"JWT"} shows the token is signed with HMAC SHA-256.

  • Expiry claim

    "exp": 1767225600 is 1 January 2026, 00:00 UTC.

FAQ

Does this verify the token?
No. Verification needs the secret or public key. Only decode here, and verify on your server.
Is it safe to paste a production token?
The token is not sent anywhere by this page, but a valid token can grant access. Prefer expired or test tokens, and never share tokens in screenshots.
Why does decoding fail?
The token must have at least two dot-separated parts, and both must be Base64URL-encoded JSON. Copy the whole token without the "Bearer " prefix.