JWT Decoder
runs in your browserno sign-upfree
Decode a JSON Web Token to read its header, payload and expiry — right in your browser.
The signature is shown but not verified.
About this tool
A JSON Web Token (JWT) is a compact, signed token used for login sessions and API authentication. This decoder splits a JWT into its header, payload and signature, shows the JSON in readable form, and explains standard claims such as issuer, subject and expiry — including whether the token has expired. Decoding happens entirely in your browser, so tokens are never sent anywhere.
How to use
- Paste a JWT into the Encoded token box (a leading “Bearer ” is fine).
- Read the decoded header and payload on the right.
- Check the status line and claims table to see when the token was issued and when it expires.
FAQ
Does this verify the signature?
No. Verifying a signature needs the secret key or public key, which you should never paste into a website. This tool only decodes the readable parts of the token.
Is it safe to paste a real token here?
The token is decoded in your browser and never uploaded. Still, treat live tokens like passwords — anyone who has one may be able to use it until it expires. The token you paste is never saved — it is gone when you close or reload the page.
Is the data in a JWT encrypted?
Usually not. A normal signed JWT is only Base64url-encoded, so anyone can read its contents. Do not put secrets in a JWT payload.
What do exp, iat and nbf mean?
They are times in seconds since 1 January 1970 (Unix time): exp is when the token expires, iat is when it was issued, and nbf is the earliest time it may be used. The tool converts them into readable dates.