JWT Decoder
Decode JSON Web Token headers and payloads. Time claims become human-readable dates, expiry status updates live. Nothing is sent anywhere.
Header
Payload
Signature
Signature shown as-is. This tool decodes but does not verify signatures — verification requires the secret or public key and belongs on your backend.
How to use
- Paste the full JWT — three base64url segments separated by dots: header.payload.signature.
- Header and payload decode instantly into formatted JSON. Claims like exp, iat and nbf also show as human-readable dates.
- Check the expiry banner: it tells you whether the token is currently valid and how long it has left (or how long ago it expired).
Frequently asked questions
Is it safe to paste a JWT into this decoder?
Yes. Decoding happens entirely in your browser with JavaScript — the token is never transmitted anywhere. That said, good practice is to avoid pasting production tokens containing sensitive claims into any website, including this one.
Does this tool verify the JWT signature?
No. This is a decoder, not a verifier. Signature verification requires the secret (for HMAC) or the public key (for RSA/ECDSA), and it is something your backend should always do. This tool shows the signature segment as-is and warns you when the alg is none.
What is the exp claim in a JWT?
exp (expiration time) is a Unix timestamp after which the token must no longer be accepted. This decoder converts exp, iat, nbf and similar numeric-date claims into human-readable dates and shows whether the token is currently expired, with a live countdown.
Why does my JWT payload look unreadable?
JWT segments are base64url-encoded, not plain base64. If you copied the token with characters missing or extra spaces, decoding fails. Make sure you paste the full token including all three segments separated by dots.