JWT Decoder
Paste a JSON Web Token and read what is actually inside it: the header, the full payload, and the standard claims with iat, nbf and exp turned into readable dates plus a live expiry check.
How to use the JWT Decoder
- Paste the token into the box — a leading 'Bearer ' is stripped automatically.
- Press decode to see the header and payload formatted as readable JSON.
- Check the summary for the algorithm, issuer, subject and the exact expiry time, then copy either section if you need it.
About the JWT Decoder
A JWT is three Base64url segments separated by dots: a header naming the algorithm, a payload of claims, and a signature. The signature is what makes a token trustworthy, but the payload is only encoded, not encrypted — anyone holding the token can read it, which is the single most misunderstood thing about JWTs and the reason you should never put a password, a card number or anything else sensitive in one. Decoding is therefore a read-only operation that needs no key at all, and it happens here entirely inside your page. This tool deliberately does not verify signatures: verification requires your secret or private key, and pasting a signing key into any website is a bad habit no matter how the site promises to behave. Verify in your own backend or with a local library instead.
Frequently asked questions
Is it safe to decode a JWT on a website?
On this page, yes — the decoding runs in JavaScript in your own browser and the token is never transmitted. As a general habit, be careful: a live access token is a credential, so prefer a local tool for production tokens.
Why does this tool not verify the signature?
Verifying needs the secret or public key that signed the token. No website should ever ask you to paste a signing key, so signature checks belong in your own server code or a local library.
What do iat, exp and nbf mean?
They are standard claims: iat is when the token was issued, exp is when it stops being valid, and nbf is the earliest time it may be used. All three are Unix timestamps in seconds, shown here as dates.
Can I put sensitive data in a JWT payload?
No. The payload is Base64url encoded, not encrypted, so anybody with the token can read it. Keep only identifiers and non-sensitive claims in it, and store the rest server-side.
Related free tools
- HTML Encode / Decode — Escape or unescape HTML entities.
- Hash Generator — SHA-256 / SHA-1 / SHA-512 of any text.
- Regex Tester — Test regular expressions with live match highlighting.
- Unix Timestamp Converter — Timestamp ⇄ human-readable date.
- Markdown Preview — Live preview of headings, bold, lists, links & code.
- CSV ⇄ JSON — Convert CSV data to JSON and back.
Runs entirely in your browser — nothing you enter is uploaded. Last reviewed and updated .