JWT Decoder
Decode a JSON Web Token to read its header, claims and expiry.
The signature is not checked. Decoding doesn’t prove who made the token.
Claims
Header
Payload
Thanks.Tell us why
Runs on your device. Nothing to upload.
Questions
Is it safe to paste a real token here?
The token is decoded in your browser and never sent anywhere, which you can check in your browser’s developer tools. Even so, treat live tokens like passwords: prefer expired or test tokens when you can.
Does this verify the signature?
No. Decoding only reads what the token says. Anyone can create a token with any content; only checking the signature with the right key proves who issued it. Never trust a token’s claims because they decode.
What do exp, iat and nbf mean?
They are times in seconds since 1970: exp is when the token expires, iat when it was issued and nbf the time before which it isn’t valid. They are shown here in your time zone.
Is it free? Do I need an account?
It is free to use and there is nothing to sign up for. There are no watermarks and no daily limits.
Missing something, or not working as it should? Tell us