JWT Decoder
Paste a JSON Web Token to see its decoded header, payload, and expiry. Decoding happens entirely in your browser — safe for real tokens.
About JWTs
A JSON Web Token has three Base64URL-encoded parts separated by dots: a header (algorithm and type), a payload (the claims — user ID, roles, expiry), and a signature. The first two parts are just encoded, not encrypted — anyone can read them, which is exactly what this tool does.
Frequently asked questions
Is it safe to paste a real production token here?
Yes. This page decodes the token with JavaScript in your browser; nothing is transmitted, logged or stored. Still, treat live tokens like passwords — don't share screenshots of them.
Does this tool verify the signature?
No. Signature verification requires the secret or public key and belongs on your server. This tool only decodes — a decoded token is not a trusted token.
What are exp, iat and nbf?
Standard timestamp claims in Unix seconds: exp = expires at, iat = issued at, nbf = not valid before. This tool converts them to readable dates and tells you if the token is expired.
Last updated: 2026-07-11