JWT Decoder
Decode JSON Web Tokens and inspect their header, payload and expiry.
- Free, no sign-up
- Files stay on your device
- Works offline
How to use the JWT Decoder
- 1
Paste your JSON Web Token into the box.
- 2
The header, payload and signature are color-coded and decoded instantly.
- 3
Check the issued-at, not-before and expiry times and whether the token has expired.
- 4
Copy the decoded header or payload as JSON.
Frequently asked questions
Everything you need to know about the JWT Decoder.
Is it safe to paste my token here?
Yes. The token is decoded entirely in your browser and never sent anywhere. Still, treat production tokens like passwords and avoid sharing them.
Does this verify the signature?
No. Decoding only reads the token's contents, which anyone can do. Verifying the signature requires the secret or public key and should happen on your server.
What do exp, iat and nbf mean?
exp is when the token expires, iat is when it was issued and nbf is the time before which it must not be accepted. All three are Unix timestamps in seconds.