This JWT decoder shows a token's header and payload in readable form, along with its issued-at (iat), not-before (nbf) and expiration (exp) claims already converted into normal dates. It's the tool you reach for when debugging authentication issues: checking what claims a token carries, or why an API keeps rejecting it as expired.
The token is processed entirely in your browser and never sent to a server. Even so, a JWT almost always identifies a real user or session, so treat it with the same care as a password.
How to use
- 1Paste your full JWT (header.payload.signature).
- 2Review the header and payload, already converted into readable JSON.
- 3Check the iat, nbf and exp dates in a human-readable format.
- 4If the token is expired or not yet valid, you'll see a clear warning next to the dates.
What you can do
- Formatted header and payload
- Readable exp, iat and nbf dates
- Expired token warning
What a JWT is and what it's made of
A JSON Web Token (JWT) is three blocks separated by dots: header.payload.signature. The header names the signing algorithm; the payload carries the token's claims, such as the user or the expiration date; the signature lets a server verify nothing was tampered with, as long as it holds the issuer's key.
The header and payload are Base64URL-encoded, not encrypted: anyone can decode them and read their contents, with or without a tool like this one. That's why sensitive data (passwords, private personal details) should never be stored directly in a JWT payload.
How to read exp, iat and nbf
These three claims are dates expressed in seconds since January 1st, 1970 (Unix epoch). iat (issued at) is when the token was created; nbf (not before) is the moment it starts being valid; exp (expiration) is when it stops being valid.
- iat: when the token was created.
- nbf: don't accept it before this date (uncommon, but it exists).
- exp: from this date on, the token should be rejected.
Decoding is not the same as verifying
This tool reads a token's contents, but it does not check its signature: that would require the secret or public key of the server that issued it, which you should never enter into a public website. A token can decode perfectly and still be fake or tampered with if its signature isn't valid.
To debug an authentication issue, this tool tells you what the token says; to confirm it's genuine, that check must always happen on the backend that issued it, using its private key.
Frequently asked questions
What is a JWT and is it safe to decode it online?
A JWT is a token carrying data in its payload, Base64URL-encoded but not encrypted: decoding it doesn't reveal anything an attacker couldn't already read with any Base64URL decoder. It's safe as long as the tool decodes it in your browser (like this one) instead of sending it to an external server.
Does this tool verify the token's signature?
No. It only decodes the header and payload so you can read them. Verifying the signature requires the issuer's secret or public key, which you should never paste into an online tool for security reasons.
What do the exp, iat and nbf fields mean?
They're dates in seconds since 1970: iat is when the token was created, nbf is when it becomes valid, and exp is when it stops being valid. This tool converts them automatically into a readable date and flags whether the token has expired or isn't valid yet.
Why won't my JWT decode?
The most common cause is a missing part: a valid JWT needs all three dot-separated sections (header, payload, signature). Also check that the text wasn't cut off while copying and has no extra spaces.
Should I paste production tokens into online tools?
As a rule, avoid it. Even though this tool never sends the token to a server, a real JWT identifies a user or session, so treat it like a credential and use test tokens whenever you can.
Is the token saved or sent to a server?
It's never sent to a server — decoding happens in your browser. If you choose to save it to your history, it will be stored in your account until you delete it, so keep that in mind if the token is sensitive.