JWT Decoder
Decode a JWT’s header and payload, explain standard claims like exp and iat, and see whether it has expired. Decodes only; never verifies or uploads.
This tool decodes but does not verify the signature: anyone can create a JWT with the same content, so do not trust a token just because it decodes. The token stays in your browser and is never put in the URL or browser storage.
How to use
- Paste a JWT into the input. A “Bearer ” prefix or line breaks are fine. Or click “Example” to try it.
- The header and payload are decoded instantly into formatted JSON. Use each section’s “Copy” button to grab it.
- “Registered claims” explains iss, sub, aud, exp, nbf, iat and jti, with times shown in your time zone.
- The status at the top tells you, by your device’s clock, whether the token is valid, expired or not valid yet.
- For a five-part encrypted JWT (JWE), you see the header and the size of each part; the content needs the key to decrypt.
FAQ
Is my JWT uploaded?
No. Decoding happens entirely in your browser. The token is never sent to a server, put in the URL or saved in browser storage, and it is gone when you close the tab. Still, a production JWT works like a login credential, so think twice before pasting one into any website.
Why is the signature not verified?
Verifying needs the issuer’s secret or public key. An HMAC secret (HS256 and friends) should never leave the server, and pasting it into a web page risks leaking it. This tool only decodes; verify the signature on your back end with a trusted library before trusting the content.
Is the content of a JWT encrypted?
A regular JWT (JWS, three parts) is signed, not encrypted. The header and payload are just Base64URL-encoded, so anyone holding the token can read them. Never put passwords or other secrets in it. Use JWE (five parts) when you need encryption.
What are the numbers in exp, nbf and iat?
They are NumericDates: seconds (not milliseconds) since 1970-01-01 UTC. exp is the expiration time, from which the token must be rejected; nbf is the time before which it must be rejected; iat is when it was issued.
Why does it say expired when the server still accepts it?
The status uses your device’s clock, which may be off. Some servers also allow a few minutes of clock skew, or do not check exp at all.
Related tools
Base64 Encode/Decode
Encode text to Base64 or decode it back, with full UTF-8 support for Chinese and emoji and a URL-safe option.JSON Formatter
Beautify, minify and validate JSON with precise line and column error locations.Unix Timestamp Converter
Convert Unix timestamps to dates and back. Detects seconds or milliseconds and shows ISO 8601, relative time and multiple time zones.Hash Generator
Compute MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hashes of any text at once, and check them against an expected value.