JWT Decoder
Paste a JSON Web Token to see the header and the payload claims laid out as JSON, with iat, exp and nbf converted to dates so you can tell at a glance whether a token has expired.
How to use it
- Paste the token — the whole thing, including all three dot-separated parts.
- The header and payload are decoded and shown as formatted JSON.
- Check the timestamps section to see when the token expires.
Why it stays private
A JWT is a bearer credential: anyone holding it can act as the user it represents. Pasting one into a third-party decoder hands that credential to a stranger. This tool decodes locally, and the page is a single static file with no network calls.
Questions
Does this verify the signature?
No, and it deliberately does not try. Decoding is just Base64 and JSON parsing. Verifying a signature requires the signing key or public key, which is a server-side operation. Treat a decoded payload as a claim, not as proof.
Is it safe to paste a real token here?
The decoding happens in your browser and nothing is sent anywhere, so it is far safer than a hosted decoder. Even so, a JWT is a password. If a token has already been exposed, revoke it rather than trusting any tool with it.
Why does the expiry look wrong?
JWT timestamps are Unix seconds in UTC. They are shown here in ISO 8601 with an explicit timezone so there is no ambiguity. A common cause of confusion is a server that issued the token with a clock that was itself out of sync.