JWT Decoder
Decode a JSON Web Token to read its header and claims, with expiry and issue times as readable dates.
How to decode a JWT
- Paste the token, e.g. from an
Authorizationheader. - Press Decode JWT.
- Read the header, the claims and whether it has expired.
- Decoding doesn't check the signature. Anyone can read a JWT, so never put secrets in one.
- Avoid pasting live production tokens into any online tool.
JWT Decoder: frequently asked questions
How do I decode a JWT?
Paste the token and press Decode JWT. You will see the header, the payload claims, readable dates for exp, iat and nbf, and whether the token has expired.
Does decoding check the signature?
No. Decoding only reads the header and payload, which are just Base64URL-encoded JSON. Verifying the signature needs the secret or public key, and should be done by your server.
Is it safe to paste a JWT here?
Tokens are decoded on the server and never stored or logged. Still, a valid token can act like a password until it expires, so avoid pasting live production tokens into any online tool.
What do exp, iat and nbf mean?
exp is when the token expires, iat is when it was issued, and nbf is the time before which it must not be accepted. All three are Unix timestamps in seconds.