JWT Decoder - Read JSON Web Tokens
A JWT is three Base64URL parts separated by dots. Paste a token to read its header and payload as formatted JSON, see the issue and expiry times in your time zone and whether the token has expired. The signature is shown but not verified - that needs the issuer's key.
Header
Payload
Claims explained
Signature not verified - that needs the issuer's key
How to use the JWT Decoder tool
- Paste the token (with or without "Bearer ").
- Read the header, the payload and the explained claims.
- Copy the JSON if you need it.
Questions and answers
Is it safe to paste my token here?
The token is decoded in your browser and never sent anywhere. Still, treat live tokens like passwords and prefer expired or test tokens when you share screens.
Does this verify the signature?
No. Verifying needs the secret or public key of the issuer. Decoding only shows what the token claims - never trust a token's content without verification on the server.
What do exp, iat and nbf mean?
exp = expires at, iat = issued at, nbf = not valid before. They are seconds since 1 January 1970 (UTC); the decoder shows them as dates.
Is my data uploaded to a server?
No. Every conversion on this page runs inside your browser with JavaScript. Your text and files never leave your computer, which is why it also works for private keys, contracts and photos.
Is the tool free?
Yes, free without sign-up and without limits other than your computer's memory. The site is paid for by the small ads on the left and at the bottom.