Developer · Free Tool
JWT Decoder
Decode a JSON Web Token's header and payload instantly, with human-readable expiry and issued-at times.
About this tool
Paste any JWT and this tool splits it into its three segments, Base64URL-decodes the header and payload, and pretty-prints both as readable JSON. If the payload contains standard time claims — exp, iat, or nbf — each is converted from Unix seconds into a local date and time, with an at-a-glance note on whether it is expired, valid, or not yet active.
Decoding happens entirely in your browser: no secret key is used or required, and the signature is shown as plain text only — it is never verified. This makes the tool safe for inspecting tokens from any source, including production tokens, since nothing is sent anywhere or validated against a key.
Common uses
- Inspect the claims inside an access or ID token while debugging an auth flow
- Check whether a token has expired without writing any code
- Verify a backend is issuing the expected header algorithm and payload claims
Frequently asked questions
Does this verify the token's signature?
No. This tool only decodes the header and payload — it never checks the signature against a secret or public key, so a decoded token should not be treated as authenticated or trustworthy without separate verification.
Is my token sent to a server?
No. All decoding happens locally in your browser using JavaScript; the token never leaves your device.
Why does it show "(expired)" next to exp?
The exp claim is a Unix timestamp for when the token stops being valid. The tool compares it to your current system time and labels it expired or valid accordingly — the same check a server would perform.
Is my data uploaded to a server?
No. This tool runs entirely in your browser using JavaScript — nothing you type is transmitted, logged, or stored anywhere. You can even use it offline once the page has loaded.