JWT Decoder
Paste a JWT to see its header and payload decoded, its registered claims explained, and whether it has expired. Signatures are never verified here — that needs a key, and no website should ask you for one.
The signature is never verified here. That needs the issuer's key, and a tool that teaches you to paste signing keys into a web form is worse than one that cannot verify. Check signatures in your own process.
Same thing, as an API
curl -X POST 'https://akifakkaya.com/api/v1/tools/jwt/decode' \
-H 'Content-Type: application/json' \
-d '{"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImRlbW8tMSJ9.eyJzdWIiOiJ1c2VyXzEyMyIsIm5hbWUiOiJBZGEgTG92ZWxhY2UiLCJzY29wZSI6InJlYWQ6cmVwb3J0cyB3cml0ZTpyZXBvcnRzIiwiaWF0IjoxNzAwMDAwMDAwLCJleHAiOjE3MDAwMDM2MDB9.8yQm2Jc5Zb9uzD1iEoQ0yRYzUq2FX3WvnKk1xWm0ZpQ"}'Free, no key, 120 requests a minute. Full endpoint reference
Header
Paste a token to begin.
About this tool
A JWT is three base64url segments, and the first two are not encrypted — anyone holding the token can read them. Decoding is therefore a formatting problem, and this page treats it as one: header, payload, and a claim-by-claim table where the registered claims get a sentence about what they are for.
The timestamps are the part people come for. exp, nbf and iat are seconds since the epoch, which is unreadable at a glance and is usually the thing being debugged, so each one is shown as an instant and as a relative time — and if the token has expired, or is not valid yet, that is stated at the top rather than left as arithmetic.
The signature is reported as present and unchecked, deliberately. Verifying it would mean this page asking for your issuer's signing key, and a tool that trains you to paste signing keys into a web form is a worse thing to exist than a tool that cannot verify. Check signatures in your own process, with your own key.
Questions
- Does this verify the signature?
- No, and that is on purpose. Verification needs the issuer's secret or public key. Asking for a secret would be dangerous, so the tool decodes and says plainly that the signature is unchecked.
- Is it safe to paste a production token here?
- Treat any token as a live credential. It is sent to the endpoint over HTTPS, decoded and returned, and nothing is stored — but the safest habit is to paste an expired or test token, and that habit is worth keeping everywhere, not just here.
- What does 'valid' mean in the response?
- That the token parsed: three segments, valid base64url, JSON inside. It says nothing about authenticity. A token with `alg: none` parses perfectly and should still be rejected by every verifier — the tool flags that case.