JWT Decoder
Decode a JSON Web Token to read its header, payload and expiry.
Decoded locally. The signature is not verified, because that needs the secret or public key.
About this tool
A JSON Web Token is three Base64URL parts joined by dots. Paste one to read the header and payload as formatted JSON, see the algorithm, and get the exp, iat and nbf times in your local format with a clear expired or not-expired status. Decoding happens in your browser, so tokens are not sent anywhere.
How to use it
- Paste the token (a leading 'Bearer ' is fine).
- Read the header, payload and time claims.
- Copy any section you need.
Frequently asked questions
Does this verify the signature?
No. Verifying needs the secret or public key. This tool only decodes, so do not treat a decoded token as trustworthy.
Is it safe to paste a production token?
Decoding is local, but treat tokens like passwords and avoid pasting live tokens into any website you do not trust.
Is a JWT encrypted?
A standard signed JWT is only encoded. Anyone holding it can read the payload, so never put secrets in it.