JWT Decoder
Decode and inspect JSON Web Tokens (JWT) - view header, payload, and expiry
Processed on your device — never uploaded
JWT Token
Frequently Asked Questions
Is it safe to decode a JWT in the browser?
Yes, JWT payloads are only Base64-encoded, not encrypted, so anyone with the token can read them. This tool runs entirely in your browser and never sends your token to any server.
Can this tool verify the JWT signature?
No, signature verification requires the secret key or public key used to sign the token, which should never be shared publicly. This tool only decodes and inspects the header and payload.
What do the exp, iat, and nbf claims mean in a JWT?
The "exp" (expiration) is when the token expires, "iat" (issued at) is when it was created, and "nbf" (not before) is the earliest time the token should be accepted. All are Unix timestamps.
How can I tell if my JWT token has expired?
Paste your token into the decoder and it will automatically compare the "exp" claim against the current time and display whether the token is expired or still valid.