JWT Decoder (Runs Locally, Nothing Sent)
Paste a JSON Web Token to see its header and payload, with exp, iat and nbf converted to readable dates. Decoding runs in your browser, so production tokens never leave your machine.
Free, no signup. Runs entirely in your browser; nothing you enter is sent anywhere.
Decoding happens in this tab only. This tool does not verify signatures: never trust a token's claims until your server has verified it with the right key.
{
"alg": "HS256",
"typ": "JWT"
}{
"sub": "1234567890",
"name": "Jane Doe",
"iat": 1767225600,
"exp": 2082758400
}| exp | 2036-01-01 00:00:00 UTC |
|---|---|
| iat | 2026-01-01 00:00:00 UTC |
What a JWT contains
A JWT is three base64url segments separated by dots: a header (the signing algorithm, alg), a payload of claims (who the token is for, sub; when it expires, exp) and a signature. The first two are only encoded, not encrypted: anyone holding the token can read them, so never put secrets in a JWT payload.
Decoding is not verifying
This page decodes; it can't tell you whether a token is genuine. Your server must verify the signature with the right key, pin the expected algorithm, and check exp, nbf, iss and aud. The decoder flags alg: none, expired tokens and tokens with no expiry, which are the issues behind many real incidents. See JWT security vulnerabilities for the full list.
Questions people ask
Is it safe to paste a JWT into an online decoder?
Only if decoding happens locally. A JWT is often a live credential, so a site that sends it to a server could log it. This decoder runs entirely in your browser and sends nothing; you can confirm that in your browser's network tab.
Can you decode a JWT without the secret key?
Yes. The header and payload are base64url-encoded, not encrypted, so anyone can read them. The secret or public key is only needed to verify the signature, which proves the token wasn't forged or modified.
What does the exp claim in a JWT mean?
exp is the expiry time as a Unix timestamp in seconds. After that moment the token must be rejected. This decoder converts it to a UTC date and warns when it's in the past or missing.