Utilzivo

JWT Decoder

Decode any JSON Web Token (JWT) to see what is inside it. Paste a token and this tool splits it into its three parts, pretty-prints the header and payload as readable JSON, and checks the exp claim — showing you the expiry date with a clear “valid” or “expired” badge. Useful for debugging authentication in your apps. The token is processed locally and never sent to a server.

How to Use the JWT Decoder

  1. Copy the JWT from your app, API response, or browser storage.
  2. Paste it into the box and click Decode JWT.
  3. Read the header (algorithm and token type) and the payload (user ID, roles, expiry, and any custom claims).
  4. Check the badge to see whether the token is still valid or has expired.

Practical example

Your login API returns a token but the frontend keeps rejecting it as expired. Paste the token here: the payload shows "exp": 1516239022 and the badge says “Expired on …” with the exact date. Now you know the backend is issuing short-lived tokens instead of the frontend misbehaving — a five-second check that saves an hour of debugging. You can also inspect custom claims like roles or permissions to confirm the token actually carries the access rights your UI expects before it renders admin screens.

Key features and benefits

  • Full decode: header and payload are base64url-decoded and pretty-printed as readable JSON.
  • Expiry badge: the exp claim is converted to a human date with an instant valid/expired indicator.
  • Format validation: malformed tokens (wrong number of parts, bad JSON) get clear error messages.
  • Unicode-safe: payloads with non-English characters decode correctly.
  • Private: decoding happens entirely in your browser — tokens often contain sensitive data, and yours never leaves the page.

Limitations

Decoding is not verification: this tool reads the token’s contents but does not check its cryptographic signature, so a tampered token will still decode. Never paste production tokens into any online tool you do not trust — although this one processes everything locally, the habit matters. Tokens without an exp claim simply show “No exp claim” instead of a validity badge.