Paste a JSON Web Token to read its header, payload and expiry time.
🔒 Tokens are decoded in your browser and never sent anywhere.
How to use the jwt decoder
- Paste the token.
- Read the decoded header and payload.
- Check the exp, iat and nbf times.
Decoding is not verifying
Anyone can read a JWT's contents – it is signed, not encrypted. Servers must verify the signature; this tool only displays the claims.
Frequently asked questions
Is it safe to paste my JWT?
This tool runs locally, but avoid pasting live production tokens into any site you don't control.
Why does it say expired?
The exp claim is in the past compared to your device clock.
Does it verify signatures?
No.