JWT Decoder: Inspect Token Header, Payload, and Expiry Locally

When debugging an API, you often stare at a long eyJhbGci... token and want to know what claims it carries and when it expires. The fastest way is to decode it. This guide explains the three-part JWT structure and shows how to inspect the Header, Payload, and time claims safely with an online JWT decoder.

What a JWT Looks Like: Three Dot-Separated Parts

A JWT (JSON Web Token, specified in RFC 7519) consists of three dot-separated segments:

The key insight: the Header and Payload are Base64URL-encoded, not encrypted. Anyone can decode and read them; only the signature requires the secret to verify.

Decode a JWT in Three Steps

1. Open the JWT decoder, paste the full three-part token
2. Click "Decode" to inspect the Header and Payload
3. Check the iat, nbf, and exp claims (displayed in your local timezone)

The tool only reads the token content, does not verify the signature, and never uploads the token.

What iat / nbf / exp Mean

• iat: issued at
• nbf: not valid before
• exp: expiration time

The common trap: these claims are Unix timestamps in seconds, and the tool formats them in your browser's local timezone, so double-check the timezone if the time looks wrong. Also keep in mind that decoding successfully does not mean the token is trustworthy: this tool does not verify signatures, and expiry checks should ultimately come from the server.

A Security Note: Do Not Paste Production Tokens into Random Online Tools

The Header and Payload are plain-text encoded, so decoding them does not leak the secret. But pasting a real production token into a third-party website hands your session data to someone else. Prefer tools that decode locally, like this JWT decoder, so the token never leaves the browser. JWT content is built on Base64URL encoding, covered in our Base64 encoding and decoding guide; if you need encryption rather than signatures, see the AES encrypt/decrypt tool.

FAQ

Does JWT decoding verify the signature?

No. The tool has no secret key, so it can only decode the Header and Payload and cannot confirm the token is trusted or unmodified.

Is my token uploaded or stored?

No. Everything happens in your browser.

Why does the time look wrong?

iat, nbf, and exp are Unix timestamps in seconds, and the tool shows them in your local timezone; verify the timezone as well.

Summary

JWT decoding is a daily routine in API debugging: understand the three-part structure, use a local decoder, and distinguish encoding from encryption, and you avoid the two most common mistakes. US developer interest in this keyword has stayed steady over the past year (Google Trends), so a local JWT decoder is worth keeping close.