JWT Decoder
Decode a JSON Web Token's header and payload, with expiry times explained
- Files never leave your device
- Runs in your browser
- Free, no sign-up, no watermark
Paste a token above, or load the sample to see how it works.
How to use JWT Decoder
Paste a JSON Web Token to read its header and payload, with each standard claim explained and timestamps such as exp and iat shown as dates. The token is decoded locally and never sent anywhere or saved. This tool decodes only; it does not verify signatures.
- 1
Paste the token into Encoded token. A leading "Bearer " is removed for you.
- 2
Read the decoded Header and Payload, shown as formatted JSON.
- 3
Check Status to see whether the token is expired or not yet valid, and what the signing algorithm means.
- 4
Use the Claims table for each claim's meaning and the dates in your time zone and UTC.
Frequently asked questions
Is it safe to paste a production token here?
The token is decoded in your browser and is never sent anywhere or saved. Still, treat live tokens like passwords and paste them only on a device you trust.
Does it verify the signature?
No. It only decodes. Anyone can create a token with any content, so don't trust the claims until your server has checked the signature with the right key.
Why can't it decode my token's payload?
A token with 5 parts is an encrypted JWE. Only its header is readable; the payload needs the decryption key.
How do I tell if a token has expired?
Status shows "Expired" or "Expires" with a relative time, plus the token's lifetime when iat and exp are present. If there is no exp claim, the tool tells you the token never expires on its own.
What does alg "none" mean?
The token is unsigned. Servers must reject it, and the tool flags it in red.