Web & encoding
JWT Decoder
Paste a JSON Web Token to see its header, payload and time claims translated into readable dates. Decoding happens entirely in your browser — the token is never transmitted.
- Runs 100% in your browser
- No signup · No uploads
- Free, unlimited use
JWT (header.payload.signature)
Examples: Demo HS256 token · Bearer format — ⌘/Ctrl + Enter converts · drop a file to load it · processed locally
Decoded output
Output is read-only. Use Copy, Download or Share to move it out.
How to use the jwt decoder tool
-
Paste the token
A Bearer prefix is accepted. Only the first two segments are read — the signature is displayed but never verified.
-
Read header and payload
Both are pretty-printed as JSON. Time claims are translated into UTC dates with relative times, and expired tokens are flagged.
-
Check before you trust
Use the claims to debug “why is my token rejected” questions — clock skew, wrong audience, or an expiry you didn’t notice.
What makes this one different
- Pretty-printed header and payload with time claims in readable dates
- Explicit EXPIRED / still valid flag and “expires in” countdown
- Base64url decoding with correct UTF-8 handling, so non-ASCII names are right
- Works with Bearer-prefixed tokens; signature shown truncated
- Runs 100% offline in the tab — tokens often carry sensitive claims
Privacy by architecture: this page contains no analytics that receive your input, and the conversion code runs in your tab. You can disconnect from the network after loading and keep working.
JWT Decoder — frequently asked questions
Is it safe to paste a JWT into a website?
With this tool, yes for the token itself — decoding is pure JavaScript in your browser and nothing is sent anywhere. But treat tokens as secrets regardless: a JWT is a bearer credential, valid for whoever holds it until it expires. For production tokens, prefer decoding locally in your own debugger.
Does this verify the signature?
No, and neither does any decoder without your secret or public key. Decoding only base64url-decodes the segments. Verification requires the signing key and belongs in your backend or a library like jose or jsonwebtoken.
Why is my token rejected even though decoding works?
The usual causes are: the exp claim has passed, the token was issued for a different audience (aud) or issuer (iss), the server clock differs enough to pull nbf into the future, or the signing key was rotated. The claims panel answers the first three instantly.
What do iat, exp and nbf mean?
iat is issued-at, exp is the expiration time and nbf is not-before. All three are Unix timestamps in seconds. A token is valid when nbf ≤ now < exp (when those claims are present).
Can I edit a token to test role checks?
You can edit the payload, but the signature will no longer match, so any server that verifies signatures will — correctly — reject it. For testing, re-sign with the key in your environment; that is the only way to test auth paths honestly.
Related tools
Searching for “jwt decode online”, “decode json web token”, “jwt expiry checker”? You are in the right place — browse all 19 tools.