A JSON Web Token is a compact string with three parts separated by dots: a header (which algorithm signed it), a payload (the claims — user id, expiry, roles), and a signature. The first two parts are just Base64URL-encoded JSON, which is why any JWT can be read by anyone who has it.

Is it safe to paste a JWT here?

The token is decoded entirely in your browser — it is never sent to any server, nothing is stored, and the page works offline. That said, treat live production tokens like passwords anywhere: this tool is ideal for development and debugging tokens.

Does this tool verify the signature?

No — and no purely client-side decoder can, honestly: verification requires the secret key (HS256) or the issuer’s public key (RS256/ES256). This tool decodes and inspects. Never treat decoded claims as trustworthy until your server has verified the signature.

What do exp, iat and nbf mean?

They are timestamps in Unix seconds. iat = when the token was issued, nbf = not valid before, exp = expiry. The tool converts each to a human-readable date in your timezone and tells you whether the token is currently expired — the single most common thing people check.

Why does my token fail to decode?

Check you copied all of it — tokens are long and often get truncated, or a trailing “Bearer ” prefix sneaks in (the tool strips that automatically). A JWT must have exactly three dot-separated parts; if the header or payload isn’t valid Base64URL JSON, the token was corrupted in transit.

Why can everyone read my JWT payload? Isn’t it encrypted?

Standard signed JWTs (JWS) are encoded, not encrypted — the signature proves who created the token and that it wasn’t modified, but hides nothing. Never put secrets in a JWT payload. (Encrypted JWTs, called JWE, exist but are rare in typical web apps.)

What does “alg: none” or a missing signature mean?

It means the token is unsigned — anyone can forge it. The tool flags tokens with an empty signature part. Production systems must reject unsigned tokens; accepting them is a classic, well-known vulnerability.

JWT Decoder

Decode a JWT’s header and payload, humanize exp/iat claims and spot expired tokens — nothing leaves your device.

Files never leave your device Instant — no upload waitFree, no sign-up

Paste your JWT

Decoding ≠ verification

This tool reads the token’s contents — it cannot check the signature (that needs the server’s secret or public key). Never trust a token’s claims just because they decode.

Decode JWT tokens — locally, with the claims made human

Debugging auth is 90% “what is actually inside this token?”. Paste a JWT above and this decoder splits it into header and payload, pretty-prints the JSON, converts exp / iat / nbf timestamps into readable dates in your timezone, and answers the question you actually came with: is this token expired? A “Bearer ” prefix pasted from a request header is stripped automatically.

Your token never leaves the browser

A JWT is a credential — pasting one into a website that ships it to a server is exactly the kind of habit attackers love. This tool decodes entirely on your device: no upload, no logging, works offline once loaded. It’s the difference between inspecting your key and mailing a copy of it to a stranger.

Decoding is not verification — we say it out loud

Plenty of tools blur this line; we won’t. Reading a token’s claims requires no secret — that’s by design, since JWT payloads are just Base64URL-encoded JSON.Verifying the signature requires the signing secret or public key and must happen on your server. This decoder tells you what a token says, never whether it can betrusted — and it flags unsigned tokens, which should always be rejected.

Handy while you debug

Copy the decoded payload with one click and format or diff it with theJSON formatter. Working out why a token expired at a weird time? Convert raw claim values with the Unix timestamp converter — exp claims are plain Unix seconds.

Frequently Asked Questions

What is a JWT?
A JSON Web Token is a compact string with three parts separated by dots: a header (which algorithm signed it), a payload (the claims — user id, expiry, roles), and a signature. The first two parts are just Base64URL-encoded JSON, which is why any JWT can be read by anyone who has it.
Is it safe to paste a JWT here?
The token is decoded entirely in your browser — it is never sent to any server, nothing is stored, and the page works offline. That said, treat live production tokens like passwords anywhere: this tool is ideal for development and debugging tokens.
Does this tool verify the signature?
No — and no purely client-side decoder can, honestly: verification requires the secret key (HS256) or the issuer’s public key (RS256/ES256). This tool decodes and inspects. Never treat decoded claims as trustworthy until your server has verified the signature.
What do exp, iat and nbf mean?
They are timestamps in Unix seconds. iat = when the token was issued, nbf = not valid before, exp = expiry. The tool converts each to a human-readable date in your timezone and tells you whether the token is currently expired — the single most common thing people check.
Why does my token fail to decode?
Check you copied all of it — tokens are long and often get truncated, or a trailing “Bearer ” prefix sneaks in (the tool strips that automatically). A JWT must have exactly three dot-separated parts; if the header or payload isn’t valid Base64URL JSON, the token was corrupted in transit.
Why can everyone read my JWT payload? Isn’t it encrypted?
Standard signed JWTs (JWS) are encoded, not encrypted — the signature proves who created the token and that it wasn’t modified, but hides nothing. Never put secrets in a JWT payload. (Encrypted JWTs, called JWE, exist but are rare in typical web apps.)
What does “alg: none” or a missing signature mean?
It means the token is unsigned — anyone can forge it. The tool flags tokens with an empty signature part. Production systems must reject unsigned tokens; accepting them is a classic, well-known vulnerability.