Private: nothing leaves your browser. No sign-up.
JWT Decoder
Paste a JSON Web Token to see its header and payload in plain readable JSON, with expiry dates translated to human dates. Decoding happens in your browser; the signature is never verified here.
Warning: never paste tokens containing real secrets or production credentials into any online tool, including this one. Decoding is not verification.
What the tool does
A JWT has three Base64URL parts separated by dots: header, payload, signature. This tool decodes the first two into readable JSON and translates the standard time claims (exp, iat, nbf) into real dates, telling you whether the token is expired and by how long.
Worked example
A payload of {"sub":"123","exp":1893456000} shows the subject claim and an expiry of New Year's Day 2030. If exp is in the past, the tool says "Expired" with how long ago.
Safety note
Decoding is not verifying. Anyone can decode a JWT, and a valid-looking payload proves nothing about authenticity without checking the signature against the issuer's key, which this tool deliberately does not do.
Planning estimate only. Results use the list prices shown and may differ from your actual bill. Terms
Frequently asked questions
What is a JWT?
A JSON Web Token is a compact way to pass signed claims between parties, commonly used for API authentication. It has three dot-separated parts: header, payload and signature.
Does this tool verify the signature?
No. It only decodes the header and payload so you can read them. Signature verification needs the issuer's secret or public key and must happen on your own server.
Why does it say my token is expired?
The exp claim is a Unix timestamp. If it is earlier than the current time, the token is expired. The tool shows the exact expiry date and how long ago it passed.
Is it safe to paste my token here?
Decoding happens locally in your browser and nothing is uploaded. Even so, never paste production tokens with real access into any web tool; treat tokens like passwords.