JWT Decoder
Paste a JSON Web Token to instantly see its decoded header and payload, plus its expiry as a readable local date.
Try next
Your files are processed locally in your browser. They are not uploaded to our servers.
How to use
- Paste your JWT into the input box.
- Read the decoded header and payload as formatted JSON.
- Check the time claims table to see when the token was issued and when it expires.
What is this tool?
JWT Decoder splits a JSON Web Token into its three parts and base64-decodes the header and payload into readable JSON, entirely in your browser. It converts the exp, iat and nbf time claims into your local timezone and flags whether the token is already expired. The signature is displayed but never verified — no secret or key ever comes near this tool, and the token itself is never sent anywhere.
Common uses
- Debugging authentication issues by inspecting a token's claims
- Checking why an API rejects a token — often it's simply expired
- Verifying that your backend puts the right claims into issued tokens
- Learning how JWTs are structured
FAQ
Does this tool verify the token's signature?
No. It only decodes the header and payload. Signature verification requires the secret or public key and should happen on your server.
Is it safe to paste a real token here?
The token never leaves your browser — decoding happens locally in JavaScript. Still, treat production tokens like passwords and prefer expired or test tokens where possible.
Why does it say my token is expired?
The payload's exp claim is compared against your device's current time. If exp is in the past, the token is expired.
Which token types are supported?
Any standard three-segment JWT (JWS compact serialization), regardless of the signing algorithm.