What does this tool do?
JWT Decoder splits a JSON Web Token into its readable parts: the header, the payload and standard fields like the expiry time. For a developer debugging an API or anyone trying to understand why a session ended, it reveals what is inside a token in seconds, without sending it anywhere.
How to use it
- Enter the text you want to encode or decode.
- The conversion happens automatically.
- Copy the result and use it safely.
How it works
A JWT is three Base64URL sections separated by dots: header, payload and signature. This tool decodes the first two and shows them as JSON, converting time claims like iat (issued at), exp (expiry) and nbf (not before) into readable dates. That lets you see at a glance which user a token belongs to, what permissions or claims it carries and exactly when it will stop being valid. The whole process happens in your browser.
An important caveat
This tool does NOT verify the signature. It only reveals the token's contents; it does not check whether the signature computed with the secret key is valid. So decoding a token cleanly does not mean it is trustworthy. Always perform signature verification on the server before relying on a token in production. Remember too that the payload is only encoded, not encrypted, so never place secrets like passwords inside it.
Frequently asked questions
Does this tell me whether the token is valid?
No. It decodes the contents and shows the expiry, but it does not verify the signature. A token can be perfectly readable yet have a forged signature, so the real validity check must happen on your server.
Where do I see when a token expires?
The exp claim in the payload holds the moment the token stops being valid as a Unix timestamp. The tool converts that value into a readable date, making it easy to tell whether the token has already expired.
Is it safe to paste my token here?
Decoding happens entirely in your browser and the token is never sent to any server. Still, because the payload is not encrypted, avoid displaying a live token where others can see your screen.
Is JWT Decoder free?
Yes. JWT Decoder and all 300+ tools on MagmaNex are completely free with no signup or account required.
Is my data safe?
Yes. Everything runs locally in your browser. The data you enter is never sent to a server, stored, or shared.
Does it work on mobile?
Yes. JWT Decoder works on phones, tablets and desktops — no app download needed.
🔒 Privacy: everything runs in your browser, your data is never sent to a server.