Decode a JWT
Inspect a compact JWT's JSON header and payload, including readable issued-at and expiration times. Decoding does not verify the signature or establish that a token is authentic.
The token stays in this browser. Decoding does not verify its signature.
What you can do with this tool
- Decode the header and payload locally from a three-part JWT.
- Show readable timestamps for iat, nbf, and exp claims.
- Clearly distinguish decoding from signature verification; tokens never leave your browser.
How to use JWT Decoder
- Paste a compact JWT with three dot-separated parts.
- Choose Decode JWT to inspect the header, payload, and time claims.
- Treat the decoded values as untrusted because the signature is not verified.
When this tool is useful
- Inspect claim names and timestamps while debugging an authentication flow.
- Check the readable contents of a token during development.
Limits and privacy
Decoding only reveals the token's encoded header and payload. It does not verify the signature, issuer, audience, or whether a token is valid, and its contents should be treated as untrusted. The token is decoded locally in your browser.
Frequently asked questions
Does decoding verify my token signature?
No. This tool only decodes the header and payload. It does not verify the signature, issuer, audience, or token validity.
Is the token sent to a server?
No. The header and payload are decoded in the browser.
Which timestamps are displayed?
Numeric iat, nbf, and exp claims are converted from Unix seconds to local readable time and ISO format.