JWT decoder
Paste a JSON Web Token and see its decoded header and payload, with the standard time claims (exp, iat, nbf) shown as readable dates and an at-a-glance expiry check. Decodes only — it does not verify the signature. Fully offline.
Open JWT decoder →What is the JWT decoder?
A tool that decodes a JSON Web Token so you can read its header and payload. The standard time claims (exp, iat, nbf) are shown as readable dates, with an at-a-glance check of whether the token has expired. It decodes only — it does not verify the signature — and everything runs in your browser, fully offline.
How to use JWT decoder
- Paste your token — Drop the full JWT — the three dot-separated parts — into the input box.
- Read the header and payload — The decoded header and payload appear side by side as formatted JSON as soon as the token is recognised.
- Check the claims and expiry — Standard claims like issuer, subject and audience are listed, and exp, iat and nbf are shown as human-readable dates with a valid-or-expired status.
Frequently asked questions
Does it verify the token's signature?
No. It decodes only. Checking the signature needs the signing secret or public key, which this tool does not handle — so a decoded token is not proof that it is authentic.
Is my token sent anywhere?
No. Decoding happens entirely in your browser and nothing is uploaded, so the tool works offline. Still, treat tokens as sensitive.
How does the expiry check work?
If the payload has an 'exp' claim, it is compared with your device's current time and shown as valid or expired, along with how long until or since that moment.
Why does my date look wrong?
The exp, iat and nbf claims are Unix timestamps shown in your local time zone. A surprising date usually means the token itself carries that value.
Tips
- Never paste production tokens you don't control — anyone with a JWT can read its payload.
- Remember the payload is only base64-encoded, not encrypted, so don't put secrets in a JWT.
- Use the expiry status to quickly confirm whether a token is still in its valid window.