ScanSpotJWT Decoder
Read a JWT's header and claims, with expiry turned into a readable date.
✅ No signup · ✅ Free forever · ✅ Files never leave your device
🔑 JWT Decoder
Read a token's header and claims, with expiry turned into a real date. Decoding is not verifying.
Paste a JSON Web Token to read its header and payload without sending it anywhere. The decoder splits the three dot-separated parts, base64url-decodes the first two and pretty-prints the JSON, then converts the familiar time claims into readable dates so you can see at a glance when a token expires. Decoding is not verifying: this shows what a token claims, not whether the signature proves it. Never paste a production token into a page you do not control.
How to use the JWT Decoder
- Paste a token, with or without the leading "Bearer ".
- Read the header to see the signing algorithm and key id.
- Read the payload for the claims — subject, issuer, audience and times.
- Check the expiry line, which converts the numeric exp claim into a date and flags a token that has already expired.
Why people use it
- Debugging an authentication flow without a server round trip.
- Confirming which algorithm a token was signed with before you trust it.
- Finding out whether a token expired, or was never valid to begin with.
- Reading the claims inside a token you were handed and do not control.
Frequently asked questions
Does this prove the token is authentic?
No. Anyone can craft a token with any payload they like; only the signature proves who issued it. This tool decodes the payload but does not verify the signature, so treat what you read as claims, not established facts.
Is it safe to paste a real token?
Decoding happens entirely in your browser, so this tool transmits nothing. Even so, a token is a bearer credential: anyone holding it can use it while it is valid. Avoid pasting production tokens into any page you do not control, including this one.
Why does a token sometimes fail to decode?
Base64url uses - and _ instead of + and /, and drops padding, so tokens copied with line breaks or trailing spaces are easy to corrupt. The decoder normalises padding and the alphabet for you; if it still fails, the token was probably mangled in transit.