JWT Decoder
Read a JSON Web Token’s header and claims. Nothing is sent anywhere.
Think a result is wrong? Report it on GitHub
About JSON Web Tokens
Decode a JWT’s header and claims and see when it expires, in your own timezone. Your token never leaves your browser: no upload, no logging, no tracking.
A JSON Web Token (JWT) is three parts separated by dots: a header saying how the token was signed, a payload of claims such as the user ID and expiry time, and a signature. The header and payload are Base64URL-encoded JSON, so anyone can read them.
Decoding is not verifying
This tool shows what a token says. It does not check that the token is genuine, which needs the issuer's key. A server must always verify the signature before trusting any claim, and must reject tokens whose header says "alg": "none".
Reading the time claims
iat is when the token was issued, nbf is the earliest time it may be used, and exp is when it expires. They are stored as seconds since 1 January 1970 UTC: for example, "exp": 1700003600 means 14 November 2023 at 23:13:20 UTC. The tool converts them to readable dates and says whether the token is currently within its valid period.
Is it safe to paste a token here?
The token is decoded inside your browser and is never stored or sent anywhere. Even so, treat live tokens like passwords: prefer tokens from test environments, and do not paste production tokens into tools you do not trust.