JWT Decoder
Inspect JWT header, payload and expiry.
About this tool
Decode a JSON Web Token to read its header and claims. Timestamps like exp, iat and nbf are shown as readable dates, and you can see at a glance whether the token has expired. The signature is not verified.
How to use it
- Paste a JSON Web Token. A leading “Bearer ” is removed automatically.
- Read the decoded header and payload.
- Check the status banner and the time claims to see when the token was issued and when it expires.
Questions
- Does this verify the signature?
- No. It only decodes the token. Verifying needs the secret or public key and should happen on your server. Never trust a token just because it decodes.
- Is it safe to paste a real token here?
- Decoding happens entirely in your browser and the token is never sent anywhere. Still, treat production tokens like passwords and prefer expired or test tokens when you can.
- What do exp, iat and nbf mean?
- exp is when the token expires, iat when it was issued, and nbf the moment before which it must not be accepted. All three are Unix timestamps in seconds.
- Can anyone read the contents of a JWT?
- Yes. The header and payload are only Base64url-encoded, not encrypted. Don’t put secrets or sensitive personal data in a JWT payload.
Something not working, or a result looks wrong? Report a problem with this tool