JWT Decoder
Paste a JSON Web Token to inspect its contents. This decoder splits the token and Base64URL-decodes the header and payload into readable JSON, and translates common timestamp claims (exp, iat, nbf) into human-friendly dates. Decoding happens entirely in your browser.
- Free — no sign-up
- Private — runs in your browser
- Instant results
How to use the JWT Decoder
- 1Paste your JWT. Add the full token, including both dots.
- 2Inspect header and payload. See the decoded JSON for each section, formatted for readability.
- 3Check the claims. Review expiry and issued-at times shown as readable dates.
Frequently asked questions
Does this verify the signature?
No. Verifying a signature requires the secret or public key and should be done server-side. This tool only decodes the readable header and payload.
Is it safe to paste my token here?
Decoding runs locally in your browser and nothing is transmitted. Still, treat live tokens as sensitive and avoid pasting production credentials into any online tool.
Learn more
What Base64 is, why it exists, where you'll run into it, and why it is not encryption — explained without the jargon.
What a Unix timestamp is, the seconds-vs-milliseconds trap, time zones, and how to convert to and from human dates.
The three parts of a JWT, how to read the claims, and the critical point that a JWT is signed — not encrypted.