Toolcedar

JWT Decoder

Decode a JSON Web Token to inspect its header and payload, and check the expiry — all in your browser, with no token ever sent.

This decodes the token only. The signature is not verified — that needs a key, which should never leave your server.

How to use the JWT Decoder

  1. Paste the token. Drop in the full token, including both dots.
  2. Read the claims. The header and payload are decoded and formatted for you.
  3. Check the timing. Expiry and issued-at claims are shown as readable dates.

Frequently asked questions

Does this verify the signature?
No, and no browser tool honestly can. Verifying requires the secret or public key, which must never leave your server. This decodes and displays the claims only.
Is it safe to paste a token here?
The decoding happens entirely in your browser and nothing is transmitted or stored. Even so, treat any token you paste into any website as one you should rotate afterwards if it is still live.
Is the payload of a JWT encrypted?
No. It is merely Base64url encoded, which anyone can reverse in seconds. The signature proves the token was not altered; it does nothing to hide the contents, so never put secrets in a payload.
What do the exp, iat and nbf claims mean?
They are timestamps in seconds since 1970: exp is when the token stops being valid, iat is when it was issued, and nbf is the earliest moment it may be accepted.

Learn more

Related tools

Last updated