JWT Decoder
Paste a JWT to read its header and payload as formatted JSON. Timestamp claims such as `exp` and `iat` are converted to readable dates and the token's expiry status is shown.
Header
Enter a value to see the result.
Payload
Enter a value to see the result.
Decoding happens in your browser. The signature is not verified — never paste production tokens into any online decoder.
About this tool
A JWT has three Base64URL-encoded parts separated by dots: header, payload and signature. The first two are encoded, not encrypted, which means anyone holding the token can read its contents.
This decoder does not verify the signature — that requires the secret or public key and belongs on your server. Use it to debug claims, audiences and expiry times during development.
Frequently asked questions
- Is a JWT encrypted?
- No. A standard JWT is only signed. The payload is Base64URL-encoded and readable by anyone, so never put passwords or secrets in it.
- Does this tool verify the signature?
- No. Signature verification needs the signing key and must happen on the server. This tool only decodes the header and payload.
- What do `exp`, `iat` and `nbf` mean?
- `exp` is the expiry time, `iat` the time the token was issued and `nbf` the earliest time it becomes valid. All three are Unix timestamps in seconds.
- Is it safe to paste a production token here?
- Decoding happens locally and nothing is transmitted, but a token in your clipboard or browser history is still a live credential. Prefer test tokens whenever possible.
- Why does decoding fail?
- The token must have at least two dot-separated Base64URL segments. Truncated tokens, extra whitespace or a `Bearer ` prefix are the usual causes.