JWT Decoder
Read the header and claims of a JWT, with timestamps in plain language.
Runs entirely in your browser. Nothing is sent or stored.
Good to know
A JWT has three parts: header, payload and signature. Header and payload are only base64url-encoded and readable by anyone.
The decoder shows the timestamps iat, nbf and exp in your time zone and tells you whether the token has expired. It does not verify the signature, for that you need the key.
If something secret is in the payload, it does not belong there. JWTs are signed, not encrypted.
Frequently asked questions
Is my token transmitted?
No. Decoding happens in your browser.
Does the tool verify the signature?
No. It only reads the header and payload. Whether a token is genuine is decided by signature verification on your server.
Why is something readable in the payload?
Because JWTs are signed but not encrypted. Do not put secrets in the payload.
More tools
Password Generator
Strong passwords and API secrets from your browser's random number generator.
JSON Formatter
Format, minify and validate JSON, with a clear error message.
Base64 Encode and Decode
Text to Base64 and back, UTF-8 safe and URL-safe if you want.
Unix Timestamp
Convert epoch seconds or milliseconds to a date and back.