JWT Decoder
Decode JWT tokens instantly — view header and payload as pretty JSON, check expiry with human-readable dates. 100% local, nothing uploaded.
About the JWT Decoder
This JWT decoder splits a JSON Web Token into its three parts and shows the header and payload as pretty-printed JSON the moment you paste it. The signature segment is displayed raw, and every part has a copy button. Base64url quirks — missing padding, - and _ characters — are handled automatically.
Time claims get special treatment: exp, iat and nbf are converted from Unix timestamps to readable dates in your local time zone, and a prominent badge tells you at a glance whether the token has already expired. That makes it the fastest way to answer the eternal debugging question: "is my token stale?"
Decoding happens entirely in your browser — the token is never sent anywhere — and the tool clearly reminds you that it only decodes: signatures are NOT verified, so never treat decoded contents as trusted.
How to Use the JWT Decoder
- 1Paste the full JWT (three dot-separated parts) into the box.
- 2Read the decoded header and payload as formatted JSON.
- 3Check the expiry badge and the human-readable exp / iat / nbf dates.
- 4Copy any section with its copy button.
Frequently Asked Questions
Is it safe to paste a JWT here?
Yes — decoding runs entirely in JavaScript in your browser, and the token is never transmitted, logged or stored. That said, treat production tokens like passwords as a general habit: a live access token pasted anywhere grants whatever access it encodes until it expires, so prefer decoding expired or development tokens when possible.
How can I check if my JWT is expired?
Paste the token and look at the badge above the decoded output. The tool reads the exp claim (a Unix timestamp), converts it to your local time and compares it with now — showing a red "Expired" badge or a green "Not expired" one. The iat (issued at) and nbf (not before) claims are also translated into readable dates.
Does this tool verify the JWT signature?
No, and that is by design. Verifying a signature requires the secret key (HS256) or the issuer's public key (RS256/ES256), which a client-side tool should not ask you to paste. This decoder is for inspecting contents. Your backend must always verify signatures with a proper JWT library before trusting any claim.
Why can everyone read my JWT payload — isn't it encrypted?
Standard JWTs (JWS) are signed, not encrypted. The header and payload are just base64url-encoded JSON — an encoding anyone can reverse, as this tool demonstrates. The signature prevents tampering, not reading. Never put passwords, secrets or sensitive personal data in JWT claims; if you need confidentiality, use encrypted JWE tokens or keep the data server-side.
What do the standard claims like sub, iss and aud mean?
sub (subject) identifies the user the token is about, iss (issuer) is who created the token, aud (audience) is who the token is intended for, exp/nbf/iat are the expiry, not-before and issued-at timestamps, and jti is a unique token ID. Applications add custom claims — roles, email, tenant IDs — alongside these.