About JWT Decoder
Paste a JWT to read its header and payload. Timestamp claims are shown as readable dates with the time remaining, and the token is checked against its own validity window.
Decoding is not verification
A JWT’s header and payload are base64url text, not encryption — anyone holding the token can read them, and anyone can craft one with whatever claims they like. Only checking the signature against the issuer’s secret or public key proves a token is genuine, which is why this tool never asks for your key.
Why tokens should never be pasted into a server
A bearer token is a credential: whoever holds it can act as its subject until it expires. Pasting one into a site that decodes server-side hands it to that server’s logs. Decoding happens locally here, and the token never leaves the page.
Frequently asked questions
- Can this verify a token’s signature?
- No, deliberately. Verification requires the signing secret or public key, and asking you to paste a signing secret into a web page would be worse advice than not verifying at all. Use your language’s JWT library on a trusted machine.
- What do exp, iat and nbf mean?
- They are NumericDate claims: seconds since the Unix epoch. exp is when the token stops being valid, iat when it was issued, and nbf the earliest time it may be accepted. This tool renders all three as dates.
- My token says it is expired but the API still accepts it.
- Expiry is enforced by whoever validates the token, not by the token itself. Some servers allow a few seconds of clock skew, and some do not check exp at all — which is a bug worth reporting.