JWT Decoder
Paste a JSON Web Token to see its decoded header and payload, including issued-at and expiry times. Decoding happens entirely in your browser — the token is never sent anywhere. Note: this tool decodes tokens; it does not verify signatures.
Frequently asked questions
Is it safe to paste a real token here?
The token is decoded locally in your browser and never transmitted. Even so, treat production tokens as credentials: prefer expired or development tokens when debugging in any online tool.
Why can anyone decode my JWT?
The header and payload of a JWT are only Base64Url-encoded, not encrypted. The signature prevents tampering, not reading. Never put secrets in JWT claims.
What do exp, iat, and nbf mean?
They are Unix timestamps: iat is when the token was issued, exp is when it expires, and nbf is the time before which it must not be accepted.