JWT Decoder

Decode a JSON Web Token to read its header and payload, with standard time claims (iat, exp, nbf) shown as readable dates and an expiry check. Decoding only, done privately in your browser.

Decoding only, the signature is not verified. Never paste production tokens you don't own.

Header
Payload
 

What is a JWT?

A JSON Web Token has three base64url-encoded parts separated by dots: a header (the signing algorithm), a payload (the claims) and a signature. The header and payload are only encoded, not encrypted, so anyone can read them, this tool simply decodes them. Standard time claims (iat, exp, nbf) are shown as readable dates.

Your token is decoded entirely in your browser; it is never sent or stored.

What this does

A JWT decoder reads the header and payload of a JSON Web Token, showing the standard time claims as readable dates and whether the token has expired.

How to use it

  1. Paste a JWT.
  2. Read the decoded header and payload.
  3. Check the iat, exp and nbf dates.
  4. See the expiry status.

How it works

A JWT is three Base64url parts separated by dots. The header and payload are decoded for reading; the signature is not verified, so it cannot confirm a token is authentic.

Example

A token’s exp claim of 1700000000 is shown as a UTC date with a clear “expired” or “valid” badge.

Sources & methodology

Last updated .

Frequently asked questions

Does this verify the signature?

No. It only decodes the header and payload so you can read them. It does not check the signature, so it cannot tell you whether a token is authentic.

Is it safe to paste a token here?

The token is decoded entirely in your browser and is never uploaded. Even so, avoid pasting production tokens you do not own, since the payload is readable by anyone.

How are the dates worked out?

JWT time claims are Unix timestamps in seconds. They are converted to readable UTC dates, and exp is compared to the current time to show whether the token has expired.