JWT Decoder

Paste a token — see the header, claims and expiry decoded instantly. Nothing is transmitted.

Quick answer: Free JWT decoder: decode JSON Web Token header and payload, inspect expiry (exp) and issued times. Client-side only — tokens never leave your browser.

How to use

  1. Open this page on any device — no signup needed.
  2. Fill in the fields above.
  3. Get your result instantly — nothing is uploaded.

About this tool

A JSON Web Token has three dot-separated Base64URL parts: header (algorithm), payload (claims) and signature. This decoder reveals the header and payload with human-readable iat/exp/nbf timestamps. Decoding is not verification — the signature can only be validated with the secret/public key on a server. Never paste production tokens anywhere you don't trust.

FAQ

Does decoding verify the token?
No — decoding just reads it. Verification requires the signing key and must happen server-side.
Is it safe to paste my token here?
Processing is local (no network), but treat tokens like passwords — use test tokens where possible.
What is the exp claim?
Expiry time as a Unix timestamp. Expired tokens must be rejected by the server.