Developer
JWT Decoder
Decoded locally — nothing is sent anywhere. A JWT's payload is plainly readable to anyone who holds it, so keeping the decode private matters.
JWT
Paste a JSON Web Token and see its header, payload, and signature broken apart and decoded, withexp, iat, and nbfclaims converted to readable dates and relative times so you can see at a glance whether a token has expired. This is a decoder, not a validator — it doesn't check the signature, since that would need the issuer's secret key. A JWT's payload is only Base64url-encoded, not encrypted, so it's already readable to anyone holding the token; the value of running this locally is that pasting a live production token — which often carries a real user ID, email, or role — never has to touch a third-party server to be inspected.
Related Tools
How to Use
- 1
Paste a JWT into the box (or click "Load sample" to try a well-known example token).
- 2
The decoded header and payload appear below as formatted JSON.
- 3
exp, iat, and nbf claims show a readable date and a relative time, with expired tokens flagged in red.
- 4
Click Copy on any section to grab the decoded JSON.
Frequently Asked Questions
Is the token I paste sent to a server?
No. A JWT is decoded entirely in your browser using Base64url decoding and JSON.parse — nothing is ever transmitted anywhere. This matters a lot for JWTs specifically, since the payload is not encrypted and typically contains real user identifiers, roles, or session data.
Does this verify the signature?
No — this is a decoder, not a validator. It shows you the header and payload exactly as encoded, but doesn't check the signature against a secret or public key, since that would require the issuing service's key material, which isn't something you'd want to hand to any tool. Use your backend or auth library to actually verify a token before trusting it.
Can anyone read a JWT's payload?
Yes — this is a common misconception. A JWT's header and payload are only Base64url-encoded, not encrypted, so anyone holding the token (or intercepting it) can decode and read the claims inside, exactly like this tool does. The signature only proves the token wasn't tampered with; it doesn't hide the contents. Never put secrets directly in a JWT payload.
What do exp, iat, and nbf mean?
"exp" is the expiry time — the token should be rejected after this moment. "iat" is issued-at, when the token was created. "nbf" is not-before, a time before which the token isn't yet valid. All three are Unix timestamps (seconds since 1970), which this tool converts to a readable date and a relative time like "expired 2 hours ago."
Why does the token need three parts separated by dots?
A JWT is structured as header.payload.signature — three Base64url-encoded segments joined by periods. The header describes the algorithm and token type, the payload carries the claims, and the signature (produced by the issuer's secret or private key) lets a server verify the token hasn't been altered.