Decode a JSON Web Token (JWT)
Paste a JWT to see its header and payload as formatted JSON, with issued-at, not-before and expiry times converted to readable dates. Decoding happens locally and the signature is deliberately not verified.
How to decode a JWT
- Paste the token into the input box. A leading "Bearer " from an Authorization header is removed automatically.
- Check the algorithm, type, signature length and time status cards.
- Read the time claims table for iat, nbf and exp in UTC, your local time and relative to now.
- Inspect or copy the decoded header and payload JSON.
Decoding is not verification
A JWT's header and payload are only Base64URL-encoded, not encrypted, so anyone holding the token can read them — and anyone can create a token with arbitrary claims. Trust a token only after your server verifies the signature with the expected key and algorithm, and rejects alg "none". If you need to decode individual segments by hand, the Base64 Decoder accepts the URL-safe alphabet.
Benefits
- Shows expiry status (expired, not yet valid, no expiry) that updates live every second.
- Decodes UTF-8 correctly, so names with accents or emoji display properly.
- Warns loudly about unsigned tokens that declare alg "none".
Limitations
- The signature is never verified — the tool has no access to your secret or public key.
- Encrypted tokens (JWE, five segments) cannot be read without the decryption key.
- The time status uses your device clock, which may differ from the server that will check the token.
Privacy and security
The token is decoded with JavaScript in this tab and is never sent anywhere — no network request contains it. Still, treat production tokens like passwords and avoid pasting them into tools you do not trust.
Read our privacy policy for details about the site as a whole.
Frequently asked questions
Is it safe to paste a real token here?
The token never leaves your browser, but a live token is a credential. Prefer expired or test tokens, and revoke any token you suspect has been exposed.
Why doesn't the tool verify the signature?
Verification needs the signing secret (HS256) or the issuer's public key (RS256, ES256). Doing it properly belongs on your server, where the key and expected algorithm are known.
What do iat, nbf and exp mean?
They are Unix timestamps in seconds: iat is when the token was issued, nbf is the earliest time it may be accepted, and exp is when it stops being valid.