JWT Decoder
Decode a JSON Web Token's header, payload, and standard claims — with expiry checking — entirely in your browser. The token is never transmitted.
How to use this tool
- Paste the token — the header and payload decode instantly.
- Standard claims (exp, iat, nbf) are translated into readable dates, with a clear expired/valid indicator.
How it works
A JWT is three Base64URL-encoded segments joined by dots: header (algorithm), payload (claims), and signature. Decoding needs no secret — the first two parts are just encoded, not encrypted, which is exactly why you shouldn't put sensitive data in a JWT payload. This tool decodes locally; it does NOT verify the signature, which requires the signing key and belongs on your server.
Tokens are credentials. Pasting one into a random website hands it to their server — this page never transmits yours, and you can verify that in your browser's network tab.
Frequently asked questions
Is it safe to paste a JWT here?
The token never leaves your browser — decoding is local, verifiable in the network tab. That said, live production tokens are credentials: the safest habit is decoding expired or staging tokens.
Does this verify the signature?
No — verification requires the signing secret or public key and should happen server-side. This tool shows you what the token claims, not whether those claims are authentic.
Why does my token show as expired?
The exp claim is a Unix timestamp; the tool compares it to your clock. Expired tokens are still decodable — they're just no longer valid for authentication.