JWT Decoder
Decode JWT header and payload with readable dates.
This tool only decodes the token. It does not check the signature, so a decoded token is not proof that it is genuine.
Header
Payload
Dates and standard claims
Signature
About this tool
JWT Decoder splits a JSON Web Token into its header, payload and signature and shows them as formatted JSON. Expiry and issue times are turned into readable dates. The token never leaves your browser, and the signature is not verified.
How to use JWT Decoder
- Paste the token (with or without “Bearer”).
- Read the header, payload and claim dates.
- Check the badge to see if it has expired.
Questions people ask
Does this verify the signature?
No. It only decodes the Base64URL parts. Verifying needs the secret or public key and must be done on your server.
Is it safe to paste a real token?
Decoding happens in your browser and nothing is sent anywhere. Still, a live token is like a password, so avoid sharing it and prefer expired or test tokens.
What are exp, iat and nbf?
They are Unix timestamps in seconds: exp is when the token expires, iat is when it was issued, and nbf is the time before which it is not valid.