JWT Decoder
Decode a JSON Web Token (JWT) to inspect its header and payload, see whether it has expired, and read the exp, iat and nbf claims as readable dates. Your token is decoded locally and never uploaded.
🔒 Runs 100% in your browser — nothing is uploaded
About the JWT decoder
Paste a JSON Web Token to instantly read its header and payload, with the standard time
claims (exp, iat, nbf) shown as readable dates and a
clear expired/valid badge. Because a JWT is effectively a credential, this decoder runs
entirely in your browser — your token is never uploaded, unlike server-side decoders where
pasting a live token could hand your session to a stranger.
Frequently asked questions
Is my token sent to a server?
No. The JWT is decoded entirely in your browser — it never leaves your device. That matters, because a JWT is a credential: pasting one into a server-side decoder could leak your session to whoever runs that site.
Does this verify the signature?
No. This tool decodes the header and payload so you can read the claims. Verifying the signature requires the secret or public key and is normally done on your server, not in a public web tool.
What do exp, iat and nbf mean?
They are standard time claims in seconds since 1970: exp = expiry, iat = issued-at, nbf = not-valid-before. This tool shows each as a readable date and tells you whether the token has expired.
Can others read a JWT?
Yes — the header and payload are only Base64URL-encoded, not encrypted. Anyone can read them. Never put secrets in a JWT payload.