JWT Decoder
Paste any JSON Web Token to decode its header and payload, see when it expires, and inspect every claim — all processed locally in your browser.
How to use the JWT Decoder
Paste a complete JWT — it has three parts separated by dots.
Click Decode token to see the header and payload as formatted JSON.
Check exp, iat and nbf claims rendered as readable dates.
Frequently asked questions
Is it safe to decode JWTs here?
The token is decoded entirely in your browser and never transmitted. Still, avoid decoding tokens containing sensitive personal data on shared or public computers.
Does this validate the signature?
No — this tool only decodes and displays the header and payload. Verifying a signature requires the secret or public key, which only your server should handle.
What do exp, iat and nbf mean?
exp is the expiry time, iat is when the token was issued, and nbf is “not before” — the earliest time the token is valid. All are Unix timestamps in seconds.