JWT Decoder
Paste a JSON Web Token to read its header, payload and expiry.
Runs entirely in your browser — nothing you paste is sent to our servers.
Decoding is not verification. A JWT payload is encoded, not encrypted — anyone holding the token can read it. Only your server, holding the signing key, can establish that a token is genuine. Never place secrets in a payload.
What this tool does
Header and payload
Every claim decoded from base64url and laid out as a readable table.
Expiry and validity window
Converts exp, iat and nbf to real dates and tells you whether the token has expired.
Algorithm
Shows the alg from the header, so you can spot a token signed with none or a weaker algorithm than you expect.
Nothing leaves your browser
Decoding is local. No request is made, so pasting a live token does not transmit it anywhere.
Frequently asked questions
Is my token sent to your servers?
No. The decoding happens entirely in your browser using JavaScript — there is no network request, and the token never leaves your machine. You can confirm this by opening your browser devtools network tab while decoding.
Does this verify the signature?
No, and no online decoder can without your signing key. Decoding reads the base64-encoded header and payload, which are not encrypted; verification requires the secret or public key and must happen on your server. Treat a decoded payload as unauthenticated input.
Why can I read the payload without a key?
A JWT payload is base64url-encoded, not encrypted. Anyone holding the token can read every claim in it. That is why you should never put secrets, passwords or sensitive personal data in a JWT payload.
What do exp, iat and nbf mean?
They are standard registered claims, all Unix timestamps in seconds. exp is when the token expires, iat is when it was issued, and nbf is the earliest time it should be accepted. This tool converts each to a readable date and tells you whether exp has passed.
My token is rejected as invalid — why?
A JWT has exactly three dot-separated parts. If yours has a different number, it may be truncated, or it may be an opaque session token rather than a JWT. A leading "Bearer " prefix is fine — this tool strips it for you.
Monitor it, don't just check it
One-off checks catch what is broken today. CertNotify watches your certificates, domains, DNS and code continuously and tells you before something breaks.