JWT Decoder
Decode a JSON Web Token to read its header and payload, with standard time claims (iat, exp, nbf) shown as readable dates and an expiry check. Decoding only, done privately in your browser.
What is a JWT?
A JSON Web Token has three base64url-encoded parts separated by dots: a header (the
signing algorithm), a payload (the claims) and a signature. The header
and payload are only encoded, not encrypted, so anyone can read them, this tool simply decodes them.
Standard time claims (iat, exp, nbf) are shown as readable dates.
Your token is decoded entirely in your browser; it is never sent or stored.
What this does
A JWT decoder reads the header and payload of a JSON Web Token, showing the standard time claims as readable dates and whether the token has expired.
How to use it
- Paste a JWT.
- Read the decoded header and payload.
- Check the iat, exp and nbf dates.
- See the expiry status.
How it works
A JWT is three Base64url parts separated by dots. The header and payload are decoded for reading; the signature is not verified, so it cannot confirm a token is authentic.
Example
A token’s exp claim of 1700000000 is shown as a UTC date with a clear “expired” or “valid” badge.
Sources & methodology
Last updated .
Frequently asked questions
Does this verify the signature?
No. It only decodes the header and payload so you can read them. It does not check the signature, so it cannot tell you whether a token is authentic.
Is it safe to paste a token here?
The token is decoded entirely in your browser and is never uploaded. Even so, avoid pasting production tokens you do not own, since the payload is readable by anyone.
How are the dates worked out?
JWT time claims are Unix timestamps in seconds. They are converted to readable UTC dates, and exp is compared to the current time to show whether the token has expired.
Related tools
Base64 Encoder & Decoder
Encode text to Base64 or decode Base64 back to text, with a URL-safe (base64url) option. UTF-8 aware, so emoji and accented characters round-trip perfectly. Runs in your browser.
URL Encoder & Decoder
Percent-encode text for safe use in URLs or decode it back, with component, full-URI and form (application/x-www-form-urlencoded) modes. Private and instant, all in your browser.
HTML Encoder & Decoder
Convert text to HTML entities or decode entities back to plain text. Handles named entities and numeric (decimal and hex) references. Escape markup safely, all in your browser.
Text Encrypt & Decrypt
Encrypt a message with a password using AES-GCM and PBKDF2, then share the Base64 result. Decrypt it back with the same password. Strong, authenticated, and entirely in your browser.