>_
JWT

JWT Decoder

Decode a JSON Web Token to see its header, payload and claims. Shows expiry status and readable dates for exp, iat and nbf. Tokens never leave your browser.

Runs locally — your input never leaves this page.

Header 
 
 Signature 
 
 
Signature is not verified — that requires the secret or public key.
 
 
 
 Payload  
 
 
 
 
 
  
 
 
 
How to use
 
     
  1. Paste a JWT (the xxxxx.yyyyy.zzzzz string, with or without the “Bearer ” prefix).
  2. The header and payload are decoded from Base64URL and pretty-printed as JSON.
  3. Standard time claims (exp, iat, nbf) are converted to readable dates and the token is marked valid or expired.
    4.  
  
FAQ
 
 
  Is it safe to paste a production token here?  
Decoding happens entirely in your browser with no network requests, so the token is not sent anywhere. Still, treat live tokens as secrets and rotate them if they leak.
 
  Does this verify the signature?  
No. Decoding only reads the header and payload. Verifying the signature requires the secret or public key, and should be done on your server.
 
 
 
  Report a bug or suggest a feature →