Zellio.io

JWT Decoder

Inspect JSON Web Token claims without sending them anywhere.

Runs locallyWorks offlineShare link carries settings, never your data
Send output toBase64 Encode / DecodeCode FormatterRegex Tester & BuilderBuild a workflow from thisOutput stays on this page until you send it.

Frequently asked questions

Do I need the signing secret to decode a token?

No. A JWT's header and payload are only Base64URL-encoded, not encrypted, so anyone holding the token can read its claims. The secret is needed to *verify* the signature, which is a different operation.

Is it safe to put sensitive data in a JWT?

No — and this is the most common mistake with them. Because the payload is readable by anyone with the token, it should carry identifiers and claims, never passwords, personal data or anything you would not print in a log.

What do exp, iat and nbf mean?

Standard claims, all Unix timestamps: exp is when the token expires, iat when it was issued, and nbf the earliest time it may be accepted. An 'expired token' error is usually exp compared against a server clock that has drifted.

Pro tips

  • Check exp first. Expiry accounts for a large share of authentication failures and is the fastest thing to rule out.
  • Treat any production token you paste into any tool as compromised, and rotate it if it protects something that matters.
  • Remember that decoding is not verification — a tampered payload decodes perfectly and only signature checking will reject it.
  • Compare aud against the service actually rejecting the token when several services share one identity provider.
  • Look for nbf when a freshly issued token is refused; a clock skew between issuer and consumer makes valid tokens temporarily unusable.

About JWT Decoder

Decoding is not verification. A JWT payload is Base64-encoded, not encrypted, so anyone holding the token can read it, and reading it here proves nothing about whether the signature is valid. Treat any production token you paste anywhere as exposed.

Paste a JSON Web Token to read its header and payload — issuer, audience, scopes and expiry — without needing a secret. Decoding happens in your browser and the token is never uploaded.

Decode a JSON Web Token's header and payload to inspect its claims, issuer, audience and expiry. JWTs are widely used for authentication and API authorisation, and being able to read them quickly is essential when debugging login flows.

The payload carries claims like issuer, audience and expiry, which is usually enough to explain why a login failed. An expired token and one signed with the wrong key look identical to the user, but the exp claim separates them in seconds.

A JSON Web Token is three Base64URL segments separated by dots: a header naming the signing algorithm, a payload of claims, and a signature computed over the first two. Only that third segment is cryptographic. The first two are merely transport-encoded, which means every claim inside is legible to whoever is carrying the token — and to anything that logs it along the way. Two rules follow: put nothing confidential in a payload, and never treat a decode as proof of anything, since well-formed Base64 is trivial to produce.

When a login fails, a handful of claims explain most cases. `exp` and `iat` give expiry and issue time as Unix timestamps, and an expired token looks identical to an invalid one from the user's side. `iss` and `aud` identify who issued the token and who it was meant for, and an audience mismatch is a common failure when several services share an identity provider. `nbf` sets a not-before time, which produces the confusing case of a token that is genuinely valid and not yet usable.

Common use cases

  • Checking why an API rejected a token as expired or invalid
  • Inspecting which claims and scopes a token actually carries
  • Confirming an auth provider is issuing the fields you expect
How it comparesjwt.io is the reference implementation and also verifies signatures when you supply the secret — genuinely useful, and it means pasting a production secret into a web page. Decoding covers the debugging case without ever asking for the key.