JWT Decoder — Decode JSON Web Tokens & Check Expiry
Read a JWT’s header, payload, and claims instantly. See exactly when it expires. Nothing leaves your browser.
Quick answer
To decode a JWT, paste the token into the KaviForge JWT Decoder. It splits the token into header, payload, and signature, pretty-prints the JSON, converts exp, iat, and nbf timestamps to readable dates, and tells you whether the token is expired. Decoding does not verify the signature.
A JSON Web Token (JWT) has three Base64URL-encoded parts separated by dots: a header describing the signing algorithm, a payload of claims, and a signature. The header and payload are not encrypted — anyone can decode them.
This decoder is built for debugging authentication: find out who a token was issued to, which scopes or roles it carries, and why it is being rejected (often because it has expired).
How to Decode a JWT
- 1Copy the token from your Authorization header, cookie, or local storage.
- 2Paste it into the JWT token box — a leading "Bearer " is removed automatically.
- 3Check the status banner to see if the token is valid, expired, or not yet valid.
- 4Review the decoded header and payload JSON.
- 5Read registered claims (iss, sub, aud, exp, iat, nbf) with human-readable dates.
Features
Header & Payload JSON
Pretty-printed, copyable JSON for both token sections.
Expiry Status
Instantly see if a token is expired, not yet valid, or has no exp claim.
Readable Timestamps
exp, iat, and nbf converted to local time and ISO 8601.
Claims Breakdown
Issuer, subject, audience, JWT ID, algorithm, type, and key ID at a glance.
Helpful Errors
Detects malformed tokens, wrong part counts, and encrypted JWE tokens.
Private by Design
Tokens are decoded locally — they are never sent to a server.
When to Use the JWT Decoder
Debug 401 Unauthorized errors
Check whether an access token has expired or has the wrong audience or issuer.
Inspect OAuth and OpenID Connect tokens
Read ID tokens from Auth0, Firebase, Cognito, Okta, or Azure AD to see user claims.
Verify roles and scopes
Confirm that a token carries the permissions your API expects.
Learn how JWTs work
Load the sample token to explore the structure of a real JWT.
About the JWT Decoder
The decoder splits the token on dots, Base64URL-decodes the header and payload, and parses them as JSON. The signature is shown but not verified, because verification requires the secret or public key.
Because JWTs often grant access to real accounts, never paste production tokens into tools that send data to a server. This tool runs entirely in your browser.
JWT Decoder FAQs
How do I decode a JWT token?
Paste the token into the KaviForge JWT Decoder. The header, payload, and claims are displayed instantly.
Can I decode a JWT without the secret key?
Yes. The header and payload are only Base64URL-encoded, not encrypted, so they can be read without a key. The key is only needed to verify the signature.
How do I check if a JWT is expired?
The decoder compares the exp claim with the current time and shows a status banner, plus the exact expiry date.
Does this tool verify JWT signatures?
No. It only decodes. Always verify signatures on your server with the correct secret or public key before trusting claims.
What do exp, iat, and nbf mean?
exp is the expiry time, iat is when the token was issued, and nbf is the time before which it must not be accepted. All are Unix timestamps in seconds.
Is it safe to paste my token here?
Decoding happens only in your browser and nothing is transmitted. Still, avoid sharing production tokens with others.
Related Tools
Base64 Decoder
Decode Base64 and Base64URL strings to text, or back to images and files. UTF-8 safe.
Unix Timestamp Converter
Convert Unix epoch timestamps to dates and dates to timestamps. Seconds, milliseconds, UTC, and local time.
JSON Formatter & Validator
Pretty print, beautify, minify, and validate JSON online free. Tree view, file upload, private browser-only.