JWT Decoder
Decode a JSON Web Token's header and payload, with expiry check.
- Runs in your browser
- Encoding
Decoding only: the signature is not verified, and your token never leaves this page.
How to use the JWT Decoder
- 1Paste a JWT (it starts with eyJ) or click Sample.
- 2Read the header and payload as tables. Time claims like exp and iat are shown as dates.
- 3Check the banner to see whether the token has expired.
Questions
Does this verify the signature?
No. It only decodes the token. Verifying needs the secret or public key and should happen on your server.
Is it safe to paste a production token?
No. Everything runs in your browser with JavaScript. Nothing you type or paste is sent to a server. Still treat tokens like passwords and avoid sharing them.
What do exp, iat and nbf mean?
exp is when the token expires, iat is when it was issued, and nbf is the time before which it must not be accepted. All are Unix timestamps in seconds.