JWT Decoder – Read a JSON Web Token's Header and Payload
This only decodes the token locally — it does not verify the signature. Never paste a token you don't control into an untrusted site.
Paste a JWT above to see its decoded header and payload.
About JWT Decoder
Paste a JWT and see its header and payload as readable JSON, with the timestamp claims translated into plain dates so you can tell at a glance whether the token has expired.
A JSON Web Token is three Base64 segments separated by dots: a header saying how it was signed, a payload of claims, and a signature. The first two are only encoded, not encrypted, so anyone holding the token can read them — which is exactly what this tool does.
The timestamp claims are the ones people usually need. exp, iat and nbf are stored as Unix seconds, which is unreadable at a glance, so they are shown as real dates alongside. That makes the common question — is this token expired, or not valid yet — answerable immediately.
What you can use it for
- Check whether a token has expired while debugging a failing API call.
- Inspect which claims, scopes or roles a token actually carries.
- Confirm the issuer and audience on a token from a third-party provider.
- See which signing algorithm a token declares in its header.
- Understand the structure of a JWT while learning how they work.
How it works, step by step
- 1
Paste the token
Drop the full JWT into the input box.
- 2
Read the header
The decoded header shows the signing algorithm and token type.
- 3
Read the payload
All claims are shown as formatted JSON.
- 4
Check the timestamps
Expiry, issued-at and not-before are shown as readable dates next to their raw values.
Frequently asked questions
Does this verify the token's signature?
No, and that is important. It decodes the header and payload only. A decoded token is not a validated one — never trust a token's contents in an application without verifying its signature against the issuer's key on your server.
Is it safe to paste a real token here?
The decoding happens entirely in your browser and nothing is uploaded. That said, a JWT is a live credential: treat it like a password, and prefer an expired or test token where you can.
Is a JWT encrypted?
Not by default. A standard signed JWT is only Base64-encoded, so anyone with the token can read its payload. The signature proves it has not been tampered with; it does not hide the contents. Never put secrets in a JWT payload.
What do exp, iat and nbf mean?
exp is the expiry time, iat is when the token was issued, and nbf is the time before which it must not be accepted. All three are Unix timestamps in seconds, shown here as readable dates too.
Why will my token not decode?
Most often it has been truncated on copy, or it is not actually a JWT. A valid token has three Base64url segments separated by two dots.