About the JWT Decoder
Decode a JSON Web Token to inspect its header and payload. The decoder handles Base64URL encoding, pretty-prints the claims and translates the standard time claims — iat (issued at), nbf (not before) and exp (expires) — into readable dates, showing whether the token has expired.
Decoding happens entirely in your browser, so production tokens are never sent to a third-party server.
How to use it
- Paste a JWT (a Bearer prefix is fine).
- Read the header, payload and expiry status.
- Click a claim in tree view to copy its path.
Features
- Header and payload decoding
- Human-readable iat / nbf / exp
- Expiry check
- Accepts Bearer tokens
Frequently asked questions
Does this verify the signature?
No. Verifying requires the secret or public key and should happen on your server. Never trust a token's claims without verifying its signature.
Is it safe to paste a real token?
The token stays in your browser. Even so, treat tokens like passwords: anyone who has a valid one can use it until it expires.
What do the parts of a JWT mean?
A JWT is header.payload.signature. The header names the signing algorithm, the payload contains claims, and the signature proves the first two parts weren't modified.