JWT Decoder
Paste a JSON Web Token and read what is inside. This JWT decoder splits the token, decodes the header and payload as formatted JSON and turns the iat, nbf and exp claims into dates. Nothing is sent to a server.
- Header and payload
- Readable expiry dates
- Runs in your browser
- No sign-up
Decoding happens only in your browser. Even so, avoid pasting live production tokens into any website.
How to use
- Paste your token. A leading "Bearer " is removed for you.
- Read the header (algorithm and type) and the payload (the claims).
- Check the readable dates and whether the token has expired.
- Copy the header or payload as JSON.
What is inside a JWT?
A JSON Web Token has three parts separated by dots: a header, a payload and a signature. The first two are Base64URL-encoded JSON, so anyone can read them. The payload carries claims such as sub (subject), iat (issued at), nbf (not before) and exp (expiry). The times are Unix seconds, shown here as dates.
Decoding is not verifying
A decoder only reads the token. It does not prove the token is genuine. The signature must be checked on your server with the secret or public key. Never trust claims you have not verified. Working with the raw data? Try the JSON formatter or the epoch converter.
Frequently asked questions
Is it safe to paste my JWT here?
The token is decoded in your browser and is not uploaded. Still, treat live tokens like passwords and prefer test tokens.
Does this verify the signature?
No. Verifying needs the secret or public key, which should stay on your server.
Why is my token shown as expired?
The exp claim is a time in the past. Request a new token from your login service.
Can anyone read the payload?
Yes. JWT payloads are encoded, not encrypted, so never put secrets in them.