JWT Decoder
Paste a JSON Web Token to instantly decode its header and payload into readable JSON. See when it was issued and when it expires — with a clear warning if it's already expired. Decoding happens locally in your browser.
How it works
A JWT is three base64url-encoded segments joined by dots: header, payload and signature. The tool decodes the first two segments with base64url decoding and pretty-prints the JSON. The exp and iat claims (seconds since the Unix epoch) are converted to readable dates.
Frequently asked questions
Does this verify the signature?
No. This tool decodes only — it does not and cannot verify the signature without the secret or public key. Never trust a token's contents without server-side verification.
Is it safe to paste a token here?
Yes. Decoding runs 100% locally in your browser; the token is never sent over the network. Still, treat tokens like passwords and avoid sharing them.
What do exp and iat mean?
exp is the expiration time and iat is the issued-at time, both expressed as seconds since the Unix epoch (1970-01-01 UTC). The tool renders them as local dates.