JWT Decoder
Paste a JSON Web Token to see its header and claims as formatted JSON, and whether it is expired or not yet valid.
Output
Your result will appear here.
WeDoConvert decodes the header and payload and checks the exp, nbf and iat claims. It does not verify the signature: no key is supplied and none is fetched.
Nothing to check yet
1 line · UTF-8
Processed locallyFiles and text are processed in your browser and are not uploaded to our servers.Learn more
How to decode a JWT
- 01
Paste the token
A JWT has three parts separated by dots: header, payload and signature.
- 02
Decode
The header and payload are decoded from Base64URL and shown together as JSON.
- 03
Check the claims
The status tells you whether exp and nbf put the token inside its validity window.
Decoding is not verifying
This tool reads the token; it does not verify the signature. No key is supplied and none is fetched, so a decoded token can have been forged or altered. Every result states that the signature was not verified.
Header fields that point at keys, such as jku, x5u and kid, are displayed as data only. The tool never requests those addresses.
Time claims
- exp (expiration): the token is shown as expired once this time has passed.
- nbf (not before): the token is shown as not active yet before this time.
- iat (issued at) is displayed with the payload.
- Claims are compared with your device clock and only checked when they are numeric timestamps.
Related tools
Frequently asked questions
Does this verify a JWT signature?
No. It decodes the header and payload only. Verifying requires the issuer's secret or public key, and should happen in your server or authentication library.
Can decoding a JWT prove that it is trustworthy?
No. Anyone can create a token with any payload. Only a verified signature shows that the token came from the issuer and was not changed.
Is it safe to paste a production token?
The token is decoded in your browser and is not uploaded to WeDoConvert servers. Treat real tokens as credentials all the same, and prefer expired or test tokens where you can.
Why is my token rejected?
The token needs exactly three non-empty, dot-separated Base64URL parts with JSON in the header and payload. Encrypted JWE tokens with five parts and unsigned tokens with an empty signature part are not decoded.