JWT Decoder
Paste a JWT to read its header and payload, see every claim in a table, and check whether the token has expired.
This decodes the token, it does not verify the signature — that needs the secret or public key, which should never be pasted into a web page. A JWT payload is only base64-encoded, not encrypted, so treat any token you paste anywhere as exposed. Decoding here happens entirely in your browser and the token is never transmitted.
Frequently Asked Questions
Does this verify the signature?
No, and deliberately so. Verifying a signature requires the secret or public key, and pasting a signing secret into any web page is a bad idea. Use your backend or a local CLI for verification.
Is it safe to paste a token here?
The decoding happens entirely in your browser with no network request, so nothing is transmitted. Even so, treat any token you paste anywhere as potentially exposed and rotate it if it protects something sensitive.
Why can anyone read my JWT payload?
Because a JWT is signed, not encrypted. The signature proves the contents were not tampered with; it does not hide them. Never put passwords or personal data in a JWT payload.
What do exp, iat and nbf mean?
They are Unix timestamps: exp is when the token expires, iat when it was issued, and nbf the earliest time it may be accepted. The tool converts all three to readable dates.