JWT Decoder
Paste a JSON Web Token to see its header, payload and claims, with a live expiry check. Decoding runs entirely in your browser, your token is never sent anywhere.
Frequently Asked Questions
A JSON Web Token (JWT) is a compact, URL-safe token used to pass claims between parties, most often for authentication. It has three Base64URL-encoded parts separated by dots: a header (algorithm and token type), a payload (the claims) and a signature.
Paste the token into the input box. The header and payload are decoded automatically by Base64URL-decoding each part and parsing it as JSON. A leading "Bearer " prefix is removed for you.
No. It only decodes the token. Verifying a signature needs the secret or public key and should be done on your server. Never trust the contents of a token that has not been verified.
Decoding happens entirely in your browser and the token is never sent to a server. Still, treat live tokens like passwords: avoid pasting production tokens that are still valid into any online tool you do not control.
exp is the expiration time, iat is when the token was issued and nbf is the time before which it must not be accepted. All three are Unix timestamps in seconds. This tool converts them to readable dates and tells you whether the token has expired.