JWT Decoder
Decode a JWT's header and payload and check expiry — without sending the token to any server.
Decoding happens entirely in your browser — the token is never transmitted. Signatures are not verified; treat production tokens with care anyway.
How it works
A JSON Web Token is three base64url-encoded parts: a header naming the
signing algorithm, a payload of claims (who the token is for, when it
expires), and a signature. The first two parts are just encoded — not
encrypted — which is why decoding needs no secret and why you should never
put sensitive data in a JWT payload. The expiry badge compares the exp
claim against your device clock; iat and nbf timestamps are shown as
human-readable dates too.
FAQ
Is it safe to paste a real token here?
The decoding is fully local — nothing leaves your browser, which is safer than server-side decoders. That said, good hygiene is to avoid pasting live production tokens into any tool; use a token from a test environment when you can.
Does this verify the signature?
No. Verification requires the signing secret or public key; this tool only base64-decodes the header and payload so you can inspect the claims. A decoded token is not a trusted token.
Why does it say my token is invalid?
A JWT must be three base64url segments separated by dots. Common causes: the token was truncated when copying, it's an opaque session token rather than a JWT, or extra characters (quotes, 'Bearer ') got included — the tool strips 'Bearer ' automatically.