Header and payload
JWTs are split into header, payload and signature sections. Formalint decodes the readable JSON sections so claims are easier to inspect.
Browser-based developer tools
JWT Decoder
Decode token headers and payloads, inspect common claims and check expiration times locally in the browser.
Decoding is not signature verification. Never trust a JWT only because it can be decoded.
Reference notes
JWT inspection without a backend
Expiration claims
Common numeric date claims such as exp, iat and nbf are converted into ISO timestamps to make debugging authentication flows easier.
No verification
A decoded JWT can still be forged. Production systems must verify the signature, issuer, audience and expiration using trusted server-side code.
Frequently asked
JWT decoder questions
Is my token sent anywhere when I decode it?
No. Decoding happens entirely in your browser. Since a JWT's header and payload are only Base64-encoded, not encrypted, this tool never needs to contact a server to read them.
Does decoding verify the token's signature?
No. This tool decodes and displays the header and payload claims for inspection. It does not verify the signature against a secret or public key, so a decoded token should never be treated as authenticated.
Why is my exp timestamp showing a strange date?
JWT timestamp claims like exp and iat are Unix seconds, not milliseconds. If a date looks wildly far in the future, check whether the value was generated as milliseconds by mistake.
Is it safe to paste a production token here?
Since processing is local, it is technically safe, but as a general practice avoid pasting tokens tied to live sessions into any third-party tool. Use a test or expired token when possible.