JWT Decoder
Paste a JSON Web Token to instantly see its decoded header and payload, pretty-printed with the registered claims (exp, iat, nbf) translated into human-readable dates so you can tell at a glance whether the token has expired. Decoding happens locally and the signature is not verified — this is an inspection tool, not a validation service.
Developer Tools
Private by default
This tool runs entirely in your browser. Your data is never uploaded to a server.
How to use
3 clear steps.
Paste the full JWT (three dot-separated Base64 sections).
Read the decoded header and payload as formatted JSON.
Check the highlighted exp / iat claims to see if the token is still valid.
Good to know
Frequently asked questions
- Is it safe to paste a real token here?
- Decoding happens entirely in your browser and nothing is transmitted. Still, treat production tokens as credentials: prefer expired ones for debugging, since anyone who obtains a live token can use it.
- Does this verify the signature?
- No. It decodes the Base64 header and payload for inspection only. Signature verification requires the signing secret or public key and must be done by your backend.
- Why can anyone decode my JWT?
- JWTs are signed, not encrypted — the payload is just Base64-encoded JSON, readable by anyone. The signature proves integrity and origin, not secrecy. Never put sensitive data in a JWT payload.