JWT Decoder
Paste a JWT to see its decoded header, payload and expiry time. Decoding happens in your browser, so your token is not sent anywhere.
Paste a JWT to see its decoded header, payload and expiry time. Decoding happens in your browser, so your token is not sent anywhere.
A JSON Web Token (JWT) has three Base64URL parts separated by dots: a header, a payload with claims, and a signature. This tool decodes the header and payload so you can read the claims, and converts iat, nbf and exp into dates.
It decodes only. It does not verify the signature, so a decoded token is not proof that the token is genuine.
No. Verification needs the secret or public key and should be done by your server. This tool only decodes.
Decoding happens in your browser and the token is not sent to a server. Still, treat real production tokens as secrets and prefer test tokens.
Issued at, not valid before, and expiration time. They are Unix timestamps in seconds.
The token is incomplete, has been altered, or is not a JWT. A JWT always has at least a header and a payload part.