⚠ Never paste production JWTs into any online tool. This tool runs 100% in your browser and sends nothing to any server — but it's still good practice to only test with sample or expired tokens.
About This Tool
This free JWT decoder decodes and inspects any JSON Web Token. Paste a JWT to instantly see its decoded header and payload as readable JSON, along with a breakdown of standard timing claims (iat, exp, nbf) and whether the token is currently expired.
This tool only decodes — it does not verify the cryptographic signature, since that would require the issuer's secret or public key. Everything happens locally in your browser; no token you paste is ever transmitted anywhere.
Frequently Asked Questions
What is a JWT?+
A JSON Web Token (JWT) is a compact, URL-safe way to represent claims between two parties, commonly used for authentication and authorization. It consists of three Base64URL-encoded segments separated by dots: a header (algorithm/type), a payload (claims/data), and a signature (used to verify the token hasn't been tampered with).
Can this tool verify a JWT's signature?+
No — this tool only decodes the header and payload, which requires no secret. Verifying the signature requires the issuer's secret key (for HMAC algorithms like HS256) or public key (for algorithms like RS256), which should never be entered into a third-party tool.
Is it safe to paste a real JWT into an online decoder?+
This tool runs entirely client-side and sends nothing to a server, so nothing you paste ever leaves your browser. That said, treat production tokens carefully — anyone who can see your screen can see the decoded payload, so it's good practice to test with sample or expired tokens rather than live session tokens.
What do the exp, iat, and nbf claims mean?+
iat (issued at) is when the token was created, exp (expiration) is when it stops being valid, and nbf (not before) is the earliest time the token may be accepted. All three are stored as Unix timestamps — this tool converts them to readable local dates automatically.
What's the difference between the JWT header and payload?+
The header describes how the token is secured — typically the signing algorithm (alg, e.g. HS256 or RS256) and token type (typ, always "JWT"). The payload contains the actual claims: user ID, roles, expiration, and any custom data the issuer chose to include.
Can a JWT be decoded without knowing the secret key?+
Yes — the header and payload are only Base64URL-encoded, not encrypted, so anyone can decode and read them without any key. The secret or private key is only needed to verify the signature (proving the token wasn't altered) or to create a new valid token.