JWT Decoder
Paste a JSON Web Token to instantly decode its header and payload, with human-readable dates and an expiry check — free and private. Tokens are decoded locally in your browser and never leave your device.
| Claim | Value | Meaning |
|---|
This tool decodes the token but cannot verify the signature, because that requires the secret or public key that signed it. Never trust a decoded payload without server-side verification.
How to use the JWT Decoder
- Paste your token. Drop a JWT into the box above — the three dot-separated parts (header, payload and signature). Use Load sample token to see how it works.
- Read the decoded parts. The header and payload are shown as formatted JSON, and standard claims like issued-at and expiry are translated into readable local dates.
- Check the status and copy. A colored banner tells you whether the token is active, expired or not yet valid. Copy the header or payload JSON with one click.
About this tool
A JSON Web Token (JWT) is a compact, URL-safe way to represent claims between two parties, used everywhere for authentication and authorization in modern APIs and single-page apps. It has three Base64URL-encoded parts separated by dots: a header describing the signing algorithm, a payload carrying the claims (who the user is, when the token expires, what scopes they hold), and a signature that lets the server confirm the token has not been tampered with. This decoder splits the token, Base64URL-decodes the first two parts and pretty-prints the JSON so you can inspect exactly what a token contains while debugging a login flow or an API integration.
It also recognizes the registered claims from RFC 7519 — iss, sub, aud, exp, nbf, iat and jti — and converts the numeric timestamps into your local date and time, then compares them to your clock to tell you if the token is expired or not yet active. Everything runs entirely in your browser using the built-in atob and JSON functions, so your tokens, secrets and personal data are never uploaded, logged or stored. Note that decoding is not verification: anyone can read a JWT, so the signature must always be checked on your server with the signing key.
Frequently asked questions
Does this tool verify the token's signature?
No. Verifying a signature requires the secret key (for HMAC algorithms) or the public key (for RSA/ECDSA), which should never be exposed in a browser. This tool only decodes the readable header and payload so you can inspect the claims. Always verify signatures on your server.
Is it safe to paste a real token here?
Yes. Decoding happens entirely in your browser with local JavaScript — the token is never sent to any server, logged or stored. That said, a JWT is not encrypted, so treat any live token as a password and revoke it if it has been shared insecurely elsewhere.
What do "exp", "iat" and "nbf" mean?
iat is the time the token was issued, exp is when it expires, and nbf ("not before") is the earliest time it becomes valid. All three are Unix timestamps in seconds; the tool converts them to your local date and time and checks them against your current clock.
Why does it say my token is invalid?
A JWT must have exactly three parts separated by dots, and the header and payload must be valid Base64URL-encoded JSON. If a part is truncated, re-wrapped by an email client, or actually an opaque token rather than a JWT, decoding fails and an error explains what went wrong.