JWT Decoder
Decode JWT headers and payloads in your browser, with claim tips and expiration status.
Tokens stay in this tab only. Nothing is saved or uploaded.
About this tool
About
This JWT decoder reads a JSON Web Token in your browser so you can inspect the header, payload claims, and expiration times. Paste a token from an Authorization header or API response and see structured JSON plus plain-English claim explanations—without uploading anything.
How it works
A compact JWT has three Base64URL parts separated by dots: header, payload, and signature. This tool decodes the first two parts as JSON and formats time claims like exp, iat, and nbf. It does not verify the cryptographic signature. Status updates live so you can see whether a token looks active, expired, or not yet valid based on the clock.
Steps
- Paste a JWT into the editor (a leading Bearer prefix is fine), or click Sample.
- Check the status bar for structure OK, Active/Expired, and the algorithm name.
- Read the Header and Payload JSON panels; copy either when needed.
- Use the Claims list for registered claim meanings and readable timestamps.
- Treat the Signature panel as opaque — this tool does not verify it.
Frequently asked questions
Is the JWT signature verified?
No. This tool only decodes the header and payload. Anyone with a token can read those parts. Signature checks need your secret or public key on a trusted verifier—not this page.
Is my token uploaded to a server?
No. Decoding runs entirely in your browser. The token is not uploaded and is not stored after you leave or clear the field.
What do exp and iat mean?
exp is the expiration time (Unix seconds). After that time, clients and servers should reject the token. iat is issued-at — when the token was created. Both are shown as local and UTC times with a relative label.
Why does it say Active or Expired?
If the payload includes exp (and optionally nbf), the status compares those times to your device clock. Active means now is after nbf (if present) and before exp. This is a time check only — not proof the signature is valid.
Can I decode a token from an Authorization header?
Yes. Paste the full value; if it starts with Bearer, that prefix is stripped automatically before decoding.
Privacy: Your token stays in this browser tab only. It is not saved to local storage and is not sent to our servers. Avoid pasting production secrets on a shared device.