JWT Decoder

How it works

1. Copy the token from your Authorization header, cookie or local storage. It is three Base64url segments separated by dots.
2. Paste it into the input box. A leading Bearer prefix and surrounding whitespace are ignored automatically.
3. Press Decode JWT. The header shows the algorithm and key id, the payload shows the claims as formatted JSON.
4. Check the time claims: exp, iat and nbf are shown both as raw Unix seconds and as readable dates, so you can see at a glance whether the token has expired.

Frequently asked questions

Does this tool verify the signature?

No. It decodes the header and payload, which are only Base64url-encoded, not encrypted. Verifying the signature requires the issuer's secret or public key and must be done on your server. Never trust claims from a token just because they decode cleanly.

Is it safe to paste a real access token here?

The decoding runs entirely in your browser; the token is never transmitted to Nouplo or anyone else. That said, a live token is still a credential. Treat it as you would a password and avoid pasting it on shared or public computers.

Why can I read the payload without a key?

A JWS (the common signed JWT) is designed to be readable. Base64url is an encoding, not encryption. The signature only proves the token was not modified; it does not hide the contents. If you need confidentiality, use a JWE (encrypted JWT) or keep sensitive data out of the payload.

What do exp, iat, nbf, iss, sub and aud mean?

exp is the expiry time, iat the time the token was issued, nbf the time before which it must not be accepted, all as Unix seconds. iss identifies the issuer, sub the subject (usually the user id), and aud the intended audience. Custom claims like roles or scopes vary by provider.

The tool says the token is invalid. Why?

A JWT must have exactly three dot-separated parts, and the first two must be valid Base64url that decodes to JSON. Common causes are a truncated copy, an extra quote or line break, or pasting an opaque session id that is not a JWT at all.