JWT Decoder
Splits a JSON Web Token into its header, payload and signature and pretty-prints the first two. Standard time claims — exp, iat and nbf — are interpreted as readable dates, and an expired token is flagged.
Decoding happens entirely in your browser. Since tokens are credentials, that is not a nicety: pasting a live access token into a server-side decoder hands someone else a working key to your session.
How to use it
- Paste a token, with or without a leading 'Bearer ' prefix.
- Read the decoded header and payload, and check the badges for the algorithm and expiry status.
- Copy any segment with its own copy button.
Why the signature is not verified
Verifying a signature requires the signing key. Asking you to paste a signing key into a web page is precisely the habit this tool exists to discourage, so the signature is displayed but explicitly marked unverified.
In practice that is the right division of labour: decoding is what you need when debugging why a claim is missing or a token has expired, and verification belongs in your backend where the key already lives.
Structure of a token
A JWT is three Base64URL segments separated by dots. The header names the signing algorithm, the payload carries the claims, and the signature covers the first two. Because the first two segments are merely encoded and not encrypted, anyone holding a token can read its contents — which is why tokens should never carry secrets.
Frequently asked questions
Is my token sent anywhere?
- No. The token is decoded in your browser and never transmitted or stored. Nothing you paste into TurboParse is written to local storage either.
Why can it not tell me whether the token is valid?
- Validity depends on the signature, which requires the signing key. The decoder reports structure and expiry, which is what you can determine from the token alone.
Is the payload of a JWT encrypted?
- No. It is Base64URL encoded, which is trivially reversible. Never put anything confidential in a token payload.
What does the exp claim mean?
- It is the expiry time as a Unix timestamp. It is shown here as a readable date along with whether the token has already expired.