Developer tools
JWT Decoder
Inspect the header and payload of a JSON Web Token, with timestamp claims converted to readable dates.
⚠️ This tool only decodes the token for inspection — it does not verify the signature. Verification requires the secret key, and a secret key should never be pasted into a web page.
What is JWT Decoder?
JSON Web Tokens are the dominant token format in web authentication. A JWT has three dot-separated parts: a header naming the signing algorithm, a payload carrying the data, and a signature proving the token has not been altered. The first two parts are merely Base64URL encoded — not encrypted.
This is where the common misunderstanding lies. Anyone holding a JWT can read everything inside it without any key whatsoever. The signature guarantees the contents were not tampered with; it does not hide them. Never put passwords or sensitive data into a payload.
This tool splits the token, decodes the first two parts and pretty-prints them as JSON. Timestamp claims such as exp, iat and nbf are stored as seconds since the epoch, which is hard to read at a glance — they are converted to your local time zone and flagged as expired or still valid.
How to use
- Paste the JWT into the input. It should be three sections separated by dots.
- The header and payload appear immediately as formatted JSON.
- Check the timestamp claims section to see when the token was issued and when it expires.
- Click Load sample if you want to see the output shape before pasting a real token.
Frequently asked questions
Is my token sent anywhere?
No. Decoding happens entirely in your browser. This deserves real thought with JWTs, because a valid token is a live key to an account — pasting one into a site whose server logs it is a genuine risk.
Why is the signature not verified?
Because verification requires the issuing server's secret key. A tool that asked you to paste that key would itself be the security hole. Signature verification belongs on the server, not in an inspection tool.
Is the payload encrypted?
No. It is Base64URL encoded, which is just an alternative representation of the same data. Anyone can read it. Never place passwords, card numbers or private data in a JWT payload.
What do exp, iat and nbf mean?
exp is when the token expires, iat is when it was issued, and nbf is the earliest time it becomes valid. All three are seconds since 1 January 1970 UTC. The tool converts them to your local time for you.