JWT Decoder
Paste a JSON Web Token to read its header and payload — and see when it was issued and when it expires.
JWT Decoder
⚠️ This tool decodes tokens only — it does not verify the signature. Never paste production secrets you don't control.
🔒 Nothing you enter is sent anywhere or stored. All processing happens in your browser.
How it works
A JSON Web Token (JWT) is three base64url-encoded parts joined by dots: a header describing the signing algorithm, a payload of claims (who the token is for, when it was issued, when it expires), and a signature. Because the first two parts are only encoded — not encrypted — you can read exactly what a token asserts without any secret.
This decoder splits the token, decodes the header and payload, pretty-prints both as JSON, and translates the standard iat, nbf and exp timestamps into human-readable dates, flagging tokens that have already expired. It's the fastest way to answer "what's actually in this token and has it expired?" while debugging authentication.
Important: decoding is not verifying. This tool does not check the signature, so a decoded payload is not proof the token is authentic. All decoding happens in your browser, so tokens are never transmitted.