JWT Decoder
Paste a JSON Web Token to see its header and claims as formatted JSON, with issued-at, not-before and expiry times converted to readable dates. Decoding happens locally — the token is never sent anywhere.
Runs in your browser
How to use
- Paste the token (with or without “Bearer”).
- Read the header and payload.
- Check the expiry status and dates.
How it works
A JWT has three Base64URL-encoded parts separated by dots: header, payload and signature. The first two are JSON and are decoded here. Time claims (iat, nbf, exp) are seconds since the Unix epoch and are converted to your local time.
The signature is not verified because that requires the issuer's secret or public key. Anyone can read a JWT's payload, so never put secrets in it.
Examples
- Payload
- {"sub":"123","exp":1893456000} → expires on 1 January 2030.
Common uses
- Debugging authentication issues
- Checking token scopes and roles
- Verifying expiry times
Privacy & security
This tool runs entirely in your browser. Your files and text are never uploaded to our servers — processing happens on your device and results are created locally. How each tool handles files
Frequently asked questions
Is it safe to paste a production token?
Decoding is local, so nothing is transmitted. Still, a valid token grants access: treat it like a password and let it expire or revoke it if exposed.
Can this verify the signature?
No. Verification needs the signing key and must happen on your server.
Last updated: