JWT decoder
See what is inside a JSON Web Token, without sending it anywhere.
A JWT is three base64 sections joined by dots, and the middle one is readable by anyone holding the token. This decodes it and reads the dates back in words, including whether it has expired. It does not check the signature, and no browser tool honestly can: that needs the secret key, which belongs on a server. Pasting a live token into somebody else site hands them the token; here it stays on your machine.
How to use it
- Paste the token.
- Read the header and payload.
- Check the expiry line.
Why use this tool
Completely private
Everything runs inside your browser. Your files and text are never sent to a server.
Free, with no limits
No sign-up, no watermarks and no cap on how many times you can use it.
Instant results
There is no upload or queue to wait for, so results appear as fast as your device can work.
Works on any device
Runs in any modern browser on phone, tablet or desktop. Nothing to install.
Frequently asked questions
- Why will it not verify the signature?
- Verification needs the signing secret. Any site offering to verify a token is asking you to paste a production secret into a web page, which is a worse idea than the problem it solves. Decoding tells you what the token claims; only your server can tell you whether the claim is genuine.
- Is it safe to paste a real token here?
- Safer than elsewhere: the decoding happens in your browser and nothing is sent to us. You can prove it by disconnecting from the internet after the page loads. Even so, a token is a credential, so treat it like one.
- What do exp, iat and nbf mean?
- Expiry, issued-at and not-before, each a count of seconds since 1970. They are shown here as ordinary dates in your own time zone, which is the quickest way to spot a clock problem.