JWT decoder — read header, payload and claims
Decode a JSON Web Token to read its header, payload and claims, with expiry checked. The token never leaves your browser.
Runs entirely in your browser — nothing is uploaded.
This tool decodes a token; it does not verify the signature. Verification needs the signing secret or public key, and you should never paste those into a website. Check signatures on your server, or with a local library.
How to use
- Paste the token. The three dot-separated parts are split and decoded immediately.
- Check the claims. Expiry, not-before, issued-at, issuer, subject and audience are pulled out and dated, with expired tokens flagged.
- Read the header and payload. Both shown as formatted JSON, each with its own copy button.
Questions
Does this verify the signature?
No, deliberately. Verification needs the signing secret or private key, and no website should ask you to paste production keys into it. Verify on your server or with a local library.
Is it safe to paste a real token here?
The decoding is entirely local — nothing is transmitted. But a JWT is a credential, and anyone who has it can use it until it expires. Treat pasting one anywhere with the same care as a password, and prefer an expired or test token.
Is the payload encrypted?
No. It is Base64url-encoded, which is not encryption. Anyone holding the token can read every claim in it. Never put anything confidential in a JWT payload.
What do exp, nbf and iat mean?
exp is when the token stops being valid, nbf is when it starts, and iat is when it was issued. All three are Unix timestamps in seconds — this tool converts them to readable UTC dates and tells you whether the token is currently in its valid window.