JWT Decoder
Runs in your browser. Your files never leave your device.
How we keep your files private
How to use JWT Decoder
- Paste your JWT.
- Read the decoded header and payload.
- Check the exp, iat and nbf dates.
Common uses
- Debugging authentication.
- Checking token expiry.
- Inspecting claims.
About this tool
Worked example
A JSON Web Token has three parts separated by dots: header.payload.signature. Decoding shows the header (algorithm) and payload (claims such as sub and exp). Decoding does not check the signature: anyone can read the contents of a token.
Common problems and fixes
- Invalid token.
- A JWT has exactly three dot-separated parts of URL-safe Base64. Copy it without the word Bearer or quotes.
- The token is expired.
- The exp claim is a Unix timestamp in seconds. Compare it with the current time in the timestamp tool.
- Is it safe to paste real tokens?
- Decoding runs in your browser and nothing is sent, but treat live tokens as secrets and avoid sharing them elsewhere.
Next steps
Frequently asked questions
Does it verify the signature?
No. It only decodes; never trust a token without verifying its signature on the server.
Is it safe to paste a token?
Decoding happens in your browser, but avoid pasting live production tokens into any tool.
What are exp, iat and nbf?
Expiry, issued-at and not-before times, as Unix timestamps.
Are my files uploaded to a server?
No. Everything runs inside your browser on your own device, so your files and text are never sent anywhere.
Is it really free?
Yes. There is no sign-up, no watermark and no limit on how often you use it.
Does it work on my phone?
Yes. It works in any modern browser on phones, tablets and computers. Very large files may be slow on older phones.