Does this tool verify the JWT signature?

No. This tool only decodes the header and payload so you can inspect the contents. Signature verification requires the secret or public key held by the issuing server.

Is my JWT sent to a server?

No. Decoding happens entirely in your browser. Nothing is uploaded or stored.

Why does my token show as invalid?

A valid JWT has three base64url-encoded parts separated by dots: header.payload.signature. Make sure you copied the full token without extra whitespace or surrounding quotes.

What are exp, iat, and nbf?

exp is the expiration time, iat is the issued-at time, and nbf is the not-before time. They are Unix timestamps stored in seconds inside the payload.

sigxlabs/Encoding Tools

JWT Decoder

Decode JSON Web Tokens and inspect header and payload. See expiry time at a glance.

jwt decoder

jwt debugger

decode jwt online

jwt inspector

Paste JWT token

How to use

1
Paste your token
Copy a JWT from your auth header, browser cookies, or logs and paste it into the input box.
2
See the decoded parts
The header and payload are decoded automatically and shown as formatted JSON.
3
Check expiry
The Issued at, Not before, and Expires timestamps are displayed with an active or expired badge.
4
Copy what you need
Use the copy button on each section to grab the decoded JSON.

FAQ

Related tools

Base64

Encode and decode Base64, URL, and URI component strings. Convert Base64 to text or image.

HEX to RGB

Convert colors between HEX, RGB, HSL, HSV, and CMYK. Live preview with one click copy.