JWT Decoder
Paste a JSON Web Token to decode its header and payload instantly. This tool runs 100% in your browser — nothing is uploaded or saved.
Important: This tool only decodes the token. Signatures are NOT verified here, so never trust a token based on this page alone — always verify it on your server.
Status:No expiry claim
How to use
- Paste your JWT into the box and click Decode (decoding also happens as you type).
- Read the header and payload as pretty-printed JSON, and copy either one with its copy button.
- Check the status badge and times box for issued-at (iat) and expiry (exp) in your local time and UTC.
- Remember: the signature is shown for reference only and is not verified by this tool.
Tips
- The payload shows claims like exp (expiry) and iat (issued at) — check exp to see whether a token has expired.
- Decoding is not verifying: anyone can read a JWT’s contents, so never put passwords or secrets inside a token.
- If the payload looks like gibberish, the token may be malformed or not a JWT — check for three dot-separated parts.