JWT Decoder
Decode a JWT’s header, payload, and expiry instantly.
100% in your browser — nothing uploadedDecode a JWT token online
Registered claims
The signature is shown as-is: it cannot be verified in the browser without the issuer’s secret or public key. This tool decodes, it does not verify.
About this JWT decoder
Paste a JSON Web Token and see its header and payload as formatted JSON, plus a breakdown of the registered claims: issuer, subject, audience, and the exp, iat, and nbf timestamps translated into readable local dates with relative times. A VALID / EXPIRED badge tells you at a glance whether the token is past its expiry — the most common reason an API suddenly starts returning 401 errors.
Tokens often carry user IDs, emails, and roles, and a leaked token can be replayed against the API that issued it. That’s why this decoder runs entirely in your browser: nothing is sent to a server, logged, or stored, unlike online decoders that process tokens remotely. Note that it decodes but does not verify — checking the signature requires the issuer’s secret or public key, which should never be pasted into a website.
FAQ
Is it safe to paste a real JWT here?
Yes — decoding runs entirely in your browser with JavaScript; the token is never uploaded, logged, or stored anywhere. That’s the difference from decoders that send tokens to a server. Even so, treat live production tokens like passwords and rotate any you believe was exposed.
What is the difference between decoding and verifying a JWT?
Decoding just reads the Base64URL-encoded header and payload — anyone can do it, no key required. Verifying checks the cryptographic signature against the issuer’s secret (HS256) or public key (RS256/ES256) to prove the token wasn’t tampered with. This tool decodes only; verification belongs on your server.
What does the exp claim mean?
exp is the expiration time as a Unix timestamp (seconds since 1970). After that moment APIs must reject the token, which is why an expired token produces 401 responses. The VALID / EXPIRED badge compares exp against your device clock, so it’s as accurate as your local time.