How to use the JWT Decoder
- Paste the token (a leading “Bearer ” is removed automatically).
- Read the decoded header and payload.
- Check the expiry status and claim dates.
About this tool
A JWT has three Base64URL-encoded parts separated by dots: a header (the signing algorithm), a payload of claims (user ID, roles, expiry) and a signature. The header and payload are only encoded, not encrypted — anyone holding the token can read them, which is why you should never put secrets in a JWT payload.
This decoder shows standard claims in plain language: exp (expiry), iat (issued at), nbf (not before), plus issuer, subject and audience. It doesn’t verify the signature — that needs the secret or public key and must happen on your server.
Frequently asked questions
Is it safe to decode a JWT online?
This tool decodes in your browser and sends nothing. Even so, a valid token can grant access, so prefer test tokens and never share production tokens.
Can this tool verify the signature?
No, by design. Verifying needs the signing key, which should never be pasted into a website.
Why does my token show as expired?
The exp claim (seconds since 1 Jan 1970 UTC) is earlier than your device’s current time. Check that your clock is correct too.