JWT Decoder

Paste a JWT below to see its header and payload decoded instantly, with issued-at and expiration times converted to readable dates. This tool only decodes the token locally in your browser — it does not verify the signature, and nothing is ever uploaded.

Signature not verified. Decoding a JWT only reveals its contents — it does not prove the token is authentic or hasn't been tampered with. Always verify the signature server-side with the correct secret or public key before trusting any of its claims. 
Paste a JWT above to see its decoded contents.

                    

                

            

        


        

            
Frequently asked questions

                            

                    
Does this verify the JWT signature?

                    

                        
No. This tool only decodes the header and payload — they're just Base64URL-encoded JSON, not encrypted. Verifying the signature requires the correct secret or public key and must be done server-side.

                    

                

                            

                    
Is my token uploaded anywhere?

                    

                        
No, everything happens locally in your browser via JavaScript; the token you paste is never sent to a server.

                    

                

                            

                    
What do iat, exp and nbf mean?

                    

                        
They're standard JWT claims: iat = issued at, exp = expiration time, nbf = not valid before. This tool automatically converts their Unix timestamps into readable dates.

                    

                

                            

                    
Is it safe to paste a real JWT here?

                    

                        
Since everything runs locally in your browser and nothing is transmitted, it's as safe as opening the token in your browser's dev tools. Still, treat access/refresh tokens as sensitive and avoid pasting production secrets into any third-party tool, including this one.