JWT Decoder
Inspect JWT header, payload, and expiry in the browser.
The signature is NOT verified. Readable content is not proof of a valid token.
The token is processed in the browser and never stored.
How to use
Four short steps to use JWT Decoder. No file uploads and no account needed.
- 1
Paste the JWT (three dot-separated parts) into the input box.
- 2
Check the header: algorithm and token type.
- 3
Read the payload: claims such as sub, iss, aud, and scope.
- 4
See the expiry translated into local time.
Key features
- Decode Base64URL header and payload with full UTF-8 support.
- Shows exp, iat, and nbf as readable local times.
- Clear marker when the token has already expired.
- Explicit warning that the signature is not verified.
- No token storage: closing the tab clears everything.
FAQ
Does this tool verify the signature?
No. Verification needs the issuer secret or public key. This tool only reads the token, so do not treat the output as proof that a token is valid.
Is it safe to paste a real token here?
The token is processed in the browser and never sent anywhere. Even so, production tokens often carry personal data; prefer test tokens or trim the sensitive parts.
Why does my token fail to parse?
Make sure it has three dot-separated parts and was not truncated when copied. Encrypted tokens (JWE) have five parts and cannot be read here.
What do exp, iat, and nbf mean?
exp is the expiry time, iat when the token was issued, and nbf when it becomes valid. All three are Unix timestamps in seconds.
About JWT Decoder
JWT Decoder opens a JSON Web Token so you can inspect its algorithm, issuer, audience, and expiry instead of guessing. The token is processed entirely in the browser: nothing is sent to a server and no history is stored. The tool states plainly that the signature is not verified, which keeps you from mistaking a readable token for a valid one.
Need something else? Browse the full catalog.
Back to catalog