JWT Decoder
Decode any JWT to inspect its header, payload, and claims. Shows expiry and human-readable timestamps. No server upload.
Paste a JWT token above to decode it
How to Use
Paste your JWT
Copy your JWT token and paste it into the input field.
Inspect the header
The header shows the algorithm (alg) and token type (typ).
Read the payload
The payload contains the claims — user data, permissions, and timestamps like iat (issued at) and exp (expiry).
Check expiry
The status badge instantly shows whether the token is still valid or has expired.
FAQ
A JSON Web Token (JWT) is an open standard (RFC 7519) for securely transmitting information between parties as a JSON object. It consists of three Base64url-encoded parts: header, payload, and signature.
Yes. All decoding happens in your browser using JavaScript's atob() function. No data is sent to any server. That said, treat JWTs like passwords — avoid pasting production tokens with sensitive claims into any online tool.
No. Signature verification requires the secret key or public key used when the JWT was signed. This tool only decodes (Base64url decodes) the visible parts — it does not validate whether the token is authentic.
"iat" (issued at) is the Unix timestamp when the token was created. "exp" (expiry) is when the token becomes invalid. "nbf" (not before) is the earliest time the token can be used.
Base64url is a variant of Base64 that uses - and _ instead of + and / and omits padding (=). It is URL-safe, which is why it is used in JWTs.