What is a JWT Decoder?
A JSON Web Token carries its claims in plain base64url encoding — decoding one needs no secret. This tool splits the token, decodes the header and payload, and highlights the expiry so you can see instantly whether a token is stale.
Decoding happens locally. The tool never verifies signatures and never asks for your signing secret — pasting production secrets into websites is exactly the habit to avoid.
How to use the JWT Decoder
- Paste the JWT into the input.
- Read the decoded header and payload side by side.
- Check the highlighted iat/exp times — expired tokens are flagged.
Frequently asked questions
Is my token sent to a server?
No — the token is decoded in your browser and never transmitted. Still, treat pasted production tokens as sensitive.
Why doesn’t the tool verify the signature?
Verification requires the signing secret or key, and a web tool asking for signing secrets would be teaching dangerous habits. Verify signatures in your own backend.
What are iat, exp and nbf?
Standard time claims: issued-at, expiry and not-before, as Unix timestamps. The tool converts them to readable dates.
My token doesn’t decode — why?
Check it has three dot-separated parts and no line breaks. Opaque (non-JWT) session tokens cannot be decoded.