JWT Decoder

Paste a JSON Web Token to decode its header, payload claims, and expiry — instantly, and 100% in your browser. Your token never leaves this page.

Advertisement

ClaimValueInterpreted
No token decoded yet.

Decoding is not verification: this tool shows what a token contains but cannot prove it is authentic. Never trust claims without server-side signature verification.

How JWT decoding works

A JWT has three parts separated by dots. The header and payload are base64url-encoded JSON — this page decodes them locally and pretty-prints the result. The registered time claims exp (expiry), iat (issued at), and nbf (not before) are converted to readable UTC dates with a live valid/expired/not-yet-valid status.

Why decode client-side?

Some online decoders send your token to their server to format it. A JWT often carries session identifiers and internal user data, so uploading it is an unnecessary risk. This decoder runs entirely on your machine — open the network tab and you'll see zero requests while you paste and inspect tokens.

FAQ

What is a JWT?
A JSON Web Token (JWT) is a compact string of three base64url-encoded parts separated by dots: a header (signing algorithm), a payload (claims like user ID, roles, expiry), and a signature. APIs use them for stateless authentication, e.g. in OAuth 2.0 and OpenID Connect flows.
Is it safe to paste my token into this decoder?
Yes. This page decodes your token entirely in your browser with JavaScript — the token is never sent to any server. You can verify this in your browser's DevTools network tab. Still, never paste tokens into tools you don't trust, and treat decoded claims as readable-by-anyone data.
Does decoding a JWT verify its signature?
No. Decoding only reveals the header and payload — anyone can decode a JWT. Verifying that the signature is authentic requires the signing secret or public key, and must be done by your server. This tool intentionally never asks for a signing secret.
How do I read the exp / iat / nbf claims?
These registered claims are Unix timestamps in seconds. This decoder converts them to human-readable UTC dates automatically and shows a live status (expired, valid, or not yet valid) so you don't have to do epoch arithmetic in your head.
Advertisement