JWT Decoder
Decode a JSON Web Token and read its header, payload and expiry.
JSON Web Token
Private by design. Tokens are decoded in your browser and never transmitted. Even so, treat any token you paste anywhere as compromised and rotate it if it is a production credential.
Frequently asked questions
What is a JWT decoder?
It splits a JSON Web Token into its header and payload segments and base64url-decodes them so you can read the claims. The signature segment is shown but not interpreted.
Does this tool verify the JWT signature?
No, and that is intentional. Verification needs the signing secret or public key, and you should never paste those into a website. Verify signatures in your own backend or with a local CLI.
Is it safe to paste a token here?
Decoding happens entirely in your browser with no network request. That said, any token pasted into any tool should be considered exposed. Use expired or test tokens where you can.
Why does my token show as expired?
The `exp` claim is a Unix timestamp in seconds. The tool compares it against your device clock, so a wrong system time on your machine can also make a valid token look expired.
About the JWT Decoder
A JSON Web Token is three base64url segments separated by dots: header, payload and signature. The first two are encoded, not encrypted, so anyone holding the token can read them. This decoder splits the token, decodes both segments and renders the standard time claims (iat, nbf, exp) as human dates alongside a live expiry countdown.
Signature verification is deliberately not offered. Verifying requires the signing secret or public key, and pasting a production signing key into a web page is exactly the habit this tool should not encourage.