JWT Decoder
Paste a JSON Web Token to inspect its header, payload claims and expiry — decoded locally, never verified or uploaded.
Runs in your browser — nothing is uploaded
| Claim | Value |
|---|
The signature is shown for inspection only — it is NOT verified here. Never trust a token just because it decodes.
Related tools
How to use the JWT Decoder
- Copy a JSON Web Token from your app, API response, or developer tools.
- Paste it into the token box — decoding happens live as you type or paste.
- Read the decoded header and payload, and check the claims table for dates such as exp, iat, and nbf shown in UTC and your local time.
- Check the expiry status line, and remember the signature below is shown for inspection only and is not verified.
Frequently asked questions
Does decoding a JWT verify it?
No. Decoding is not verifying. Anyone can create or change the header and payload of a token and it will still decode perfectly here. Verification means checking the cryptographic signature with the issuer's key, which this tool does not do — never trust a token just because it decodes.
Is my token uploaded to a server?
No. The token is decoded entirely in your browser using JavaScript. It is never uploaded, stored, or sent anywhere. Even so, avoid pasting production tokens into any tool on a shared machine.
What are the three parts of a JWT?
A JWT has three Base64URL-encoded segments separated by dots: the header (algorithm and token type), the payload (the claims), and the signature. This tool decodes the first two as JSON and shows the third segment as-is.
What do exp, iat, and nbf mean?
exp is the expiry time, iat is the time the token was issued, and nbf is the time before which the token must not be accepted. All three are Unix timestamps in seconds, and this tool also shows them as human-readable UTC and local dates.
Why does my token fail to decode?
Common causes are a token that does not have exactly three dot-separated segments, a segment that is not valid Base64URL, or a decoded segment that is not valid JSON — for example, a token that was truncated when copied.