JWT Decoder
Decode JSON Web Tokens instantly: see the header and payload as pretty JSON, plus readable expiry, issued-at and not-before times.
Runs in your browser — your data never leaves your deviceDecoding only — the signature is not verified. Your token is decoded locally and never leaves this browser. Don’t trust the claims until your server has checked the signature.
Paste a token to see its header.
Paste a token to see its payload.
How to use JWT Decoder
- 1
Paste your token
Paste a JWT (three dot-separated parts). It is decoded locally as you type.
- 2
Read the claims
Header and payload are shown as formatted JSON with each part colour-coded.
- 3
Check the timing
See when the token was issued, when it becomes valid and whether it has expired.
Frequently asked questions
Is it safe to paste my JWT here?
The token is decoded entirely in your browser with JavaScript — it is never sent to MagicDocTool or anyone else. Still, treat live production tokens like passwords: anyone who has one can use it until it expires.
Does this tool verify the JWT signature?
No. It only decodes the Base64URL header and payload so you can read them. Verifying requires the secret (HS256) or public key (RS256/ES256) and must be done by your server before trusting any claim.
What do exp, iat and nbf mean?
They are Unix timestamps in seconds: iat is when the token was issued, nbf is the earliest time it may be accepted, and exp is when it expires. The decoder converts them to your local time and tells you whether the token is currently valid.
Why can’t I decode my token?
A standard signed JWT (JWS) has three Base64URL parts separated by dots. Tokens with five parts are encrypted (JWE) and need a key to read. Opaque access tokens from some providers are not JWTs at all.