Skip to content
DevTools

JWT Decoder

JWT → JSON

Read a token's header and payload, with expiry shown as a real date.

token

About JWT Decoder

A JSON Web Token is three base64url-encoded parts joined by dots: a header saying how it was signed, a payload of claims, and a signature. Paste one and all three are split apart and decoded, with the registered claims labelled — iss, sub, aud, exp, nbf, iat — so you are not guessing what each abbreviation stands for.

The time claims are the ones people usually came to read. exp, nbf, and iat are seconds since the Unix epoch, which is unreadable at a glance, so each is shown as a local date alongside the raw number, and a banner at the top says plainly whether the token is currently valid, expired, or not yet in force.

Decoding happens entirely in this tab. That matters more here than for most tools: a JWT from a real environment is a live credential, and pasting one into a site that posts it to a backend hands over a working key. Nothing on this page leaves your browser.

Common questions

Does this verify the signature?
No, and no browser tool honestly can for the common case. Verifying an HS256 token requires the shared secret, and an RS256 token requires the issuer's public key. Decoding shows what a token claims; only your server can confirm those claims were not tampered with.
Is a JWT encrypted?
No. The header and payload are base64url-encoded, not encrypted, and anyone holding the token can read them — including this page, offline. The signature prevents modification, not inspection, so never put secrets in a payload.
Is it safe to paste a production token here?
The token stays in your browser; there is no server to receive it. That said, a token in your clipboard or terminal history is still a live credential until it expires, so treat it with the same care you would a password.
Why does my token show as expired when it just worked?
Expiry is compared against your computer's clock. If the machine's time is off, or you are reading a token issued for a different timezone-configured environment, the verdict can disagree with the server that issued it.

This page does the work itself, in this tab. Nothing you paste is sent to a server. Close the tab and no copy remains.