Free tool · Developer utilities
JWT decoder
Paste a JWT to see its header, payload and claims, with exp, iat and nbf as real dates. Decoded locally.
Runs in your browser. Nothing you paste is uploaded.
About this tool
JWT decoder: how it works
When a customer says "the API keeps returning 401", the token is usually the first thing to check. Paste it here to see who it was issued to, for which audience, and whether it already expired. Time claims like exp, iat and nbf are shown as dates in your time zone with how long ago or how far away they are.
The decoder handles Base64URL without padding and UTF-8 in claims, which trips up the usual atob one-liner. It flags tokens with alg: none, since a server should never accept those.
It does not verify the signature. That needs the signing secret or public key, and it belongs on your server, not in a web page. For how Ticketdesk handles API keys and tokens, see security and the API reference.
What it does
- Decodes as you paste, Bearer prefix allowed
- Header, payload and signature split by color
- Expired, not yet valid and alg none warnings
- Claims table with readable dates and time left
Building on Ticketdesk?
Automate tickets, AI agents and inboxes from your own code.
FAQ
JWT decoder: common questions
Is it safe to paste a JWT here?
The token is decoded in your browser and never sent anywhere. Still, a JWT is a credential: anyone who has it can use it until it expires. Prefer test tokens, and revoke a production token if you pasted it somewhere you do not trust.
Why does it say my token is expired?
The exp claim is earlier than your computer's clock. If the token was just issued, check the clock on the server that issued it, since clock drift of a few minutes is a common cause.
Does this tool verify JWT signatures?
No. Verification needs the secret (HS256) or public key (RS256, ES256) and should happen on your server with a JWT library.
What do the standard JWT claims mean?
iss is who issued it, sub who it is about, aud who it is for, exp when it expires, nbf when it starts being valid, iat when it was issued and jti a unique token ID. Anything else is a custom claim.