JWT Decoder: Decode & Inspect JWT Tokens Online | Free Tool

A Changing the payload after decoding breaks the signature. The signature is a cryptographic hash of the encoded header and payload combined with a secret key. If you modify even one character in the payload, the signature won't match. That's the whole point of JWTs — tamper detection. Think of it like a sealed envelope with a wax stamp. Our tool shows you what's inside, but altering it invalidates the token entirely.

A The 'iat' (issued at) claim is a Unix timestamp in seconds. If your system clock is off by more than a few minutes, you'll see a future date. Most servers allow a 30-60 second leeway. Check your device's time sync first — that's the usual culprit. Our tool converts that timestamp to a human-readable date so you can spot mismatches instantly.

A It handles standard JWTs reliably. But a token with missing dots, invalid Base64 padding, or stray characters will trigger a clear parsing error — you'll see exactly where it breaks. For example, if the payload contains an extra '=' sign, the tool highlights the mismatch. Good for debugging malformed tokens from third-party APIs. Start with a properly encoded token to avoid false alarms.

A Yes, absolutely. A JWT is like a digital key — anyone holding it can impersonate the user until it expires. That's why you should never paste tokens from production into random websites. Our tool runs fully client-side, so your token stays on your machine. Always use HTTPS, set short expiration times (15 minutes or less), and revoke tokens server-side when sessions end. A leaked JWT with a 24-hour expiry is a security risk.

A The 'nbf' (not before) claim means the token isn't valid until that timestamp. Servers reject it if used too early, which is common with clock drift between systems. Check if your token issuer's clock is synchronized via NTP. Our tool converts that Unix timestamp into your local time zone so you can compare it against the current time. If 'nbf' is 30 seconds ahead, wait before testing.

A Paste your token into the text area, then hit 'Decode' — results appear in the panel on the right, never in the browser console. No network requests fire either, so it won't show up in DevTools' Network tab. One gotcha: if you copy the token from the URL bar, make sure you grab the full string, not a truncated version. Some URLs have query params that can cut off the signature. I'd also clear your clipboard afterwards if you're on a shared machine.

A You'll see a clear warning banner at the top of the results panel, and the signature section will show a red mismatch indicator. The header and payload still decode fine, but you shouldn't trust any of those claims. For example, if you're testing an API response and get this, the token was likely altered in transit or signed with a different secret. Our tool doesn't try to verify the signature cryptographically, so it won't guess why they differ. Check your signing key and the exact token string you pasted — a stray space or missing character in the signature is the usual cause.

A They probably aren't identical — one might have a trailing space or a different Base64URL padding. Even a single character difference in the signature section changes the decoded output. That said, the header and payload decode independently, so if those match, the claims will too. But if you're comparing tokens from two different login events, the 'iat' and 'jti' claims will almost always differ. Pasted both side by side? Our tool shows a character count under each decoded section so you can spot the discrepancy fast. I'd start there before blaming the server.

A Look directly at the 'exp' claim in the payload section after pasting your token. This Unix timestamp represents the exact second your session dies, like 1715000000. Our tool automatically converts that number into your local time zone so you don't have to do the math. If that time has passed, your API calls will return a 401 Unauthorized error. Always check this field first when troubleshooting sudden login failures.

A Your tokens never leave your browser when you paste them here. The decoder runs completely client-side using JavaScript, meaning zero data gets sent to any external server. You can verify this by checking your browser's network tab while decoding a token. Backend developers testing sensitive production tokens can use this safely without risking data leaks.