JWT Decoder (JSON Web Token)
Paste a JSON Web Token (JWT) and see its contents instantly: it decodes the header and payload from base64url and pretty-prints the JSON. It recognizes the dates (exp, iat, nbf) and tells you whether the token is still valid. Everything happens in your browser, and it does not verify the signature.
How to decode a JWT
- Paste your JWT (the three parts separated by dots) into the box.
- The header and payload are decoded instantly.
- Review the recognized dates (issued at, expires, valid from) and whether the token is still valid.
- Copy the header or the payload with its button. The signature is shown, but not verified.
Frequently asked questions
What is a JWT?
A JSON Web Token (JWT) is a compact format for transmitting signed data between systems, widely used in authentication. It has three parts separated by dots: header, payload and signature, all in base64url.
Does this tool verify the signature?
No. It only decodes and displays the contents of the header and the payload. It does not check the signature or the cryptographic validity of the token: for that you need the secret or public key on your server.
Is it safe to paste my token here?
The token is decoded entirely in your browser and is not sent to any server. Even so, avoid pasting production tokens or ones with sensitive data: a JWT is not encrypted, so anyone who has it can read its contents.
Is the JWT encrypted?
No. The contents are encoded in base64url, not encrypted. Anyone can read them. The signature only guarantees that the token has not been tampered with; it does not hide the data.
What do exp, iat and nbf mean?
They are standard dates in Unix seconds: “iat” (issued at) is when the token was issued, “exp” (expiration) is when it expires and “nbf” (not before) is when it becomes valid. We show them in your local time and indicate whether the token is still valid or expired.
Is it processed on a server?
No. All the decoding happens in your browser; your token never leaves your device.