JWT Decoder
Decode a JWT's header and payload and inspect standard claims like expiry.
How to use JWT Decoder
- Paste a JWT (three base64url segments separated by dots) into the input box.
- The decoded header and payload appear instantly as formatted JSON.
- Standard timestamp claims (exp, iat, nbf) are shown as readable dates, with an expired/valid indicator for exp.
About this tool
The JWT Decoder splits a JSON Web Token into its header, payload, and signature, decodes the header and payload from base64url into readable JSON, and highlights standard timestamp claims (exp, iat, nbf) as human-readable dates — including whether the token has expired. This only decodes the token; it does not and cannot verify the signature, since that requires the secret or public key the token was signed with. All decoding runs instantly in your browser — nothing is uploaded or sent to a server, so it's safe to paste tokens containing sensitive claims.
Frequently Asked Questions
Does this verify the JWT's signature?
No — this tool only decodes the header and payload, which is just base64url encoding, not encryption. Verifying the signature requires the secret key (for HMAC algorithms) or public key (for RSA/ECDSA), which this tool never asks for or has access to.
Is it safe to paste a real JWT here?
Decoding happens entirely in your browser — the token is never sent anywhere. That said, JWT payloads are only base64-encoded, not encrypted, so anyone who has the token can already read its contents; treat tokens with sensitive claims the same way you'd treat any other credential.
What do exp, iat, and nbf mean?
iat is when the token was issued, exp is when it expires and should no longer be accepted, and nbf ('not before') is the earliest time the token is valid. All three are Unix timestamps (seconds since 1970), which this tool converts to readable dates.