JWT decoder
Decode a JSON Web Token: header, payload, issued and expiry dates in readable form. The token is read in your browser and never sent.
- Free
- No sign-up
- No file uploaded
- Windows, Mac, Android, iPhone
Loading the tool…
About this tool
Paste a JWT (with or without “Bearer”) to read its header, payload and iat, nbf and exp dates in local time. Unlike many sites, the token is never transmitted: you can decode a production token with no risk of leaking it.
How to use
- Paste the token.
- Read the decoded header and payload.
- Check the expiry date.
Common problems and fixes
“Three parts” expected
A JWT looks like xxx.yyy.zzz. Check the token was not cut off when copying.
My token is expired right after creation
Check the server's and your device's clock: exp is in UTC seconds.
The payload is unreadable
It may be a JWE (encrypted token, five parts): it can only be read with the decryption key.
Frequently asked questions
Is the token sent to a server?
No. Decoding is done by your browser; nothing is sent or stored.
Is the signature verified?
No: that would require the server's secret or public key. A decoded payload is therefore not proof of authenticity.
Is a JWT encrypted?
No, a signed JWT (JWS) is only Base64URL-encoded: never put secrets in its payload.
What do iat, nbf and exp mean?
iat: issued at; nbf: not valid before; exp: expiry. All in Unix seconds.
Related searches
Still stuck?
Ask on the forum: the category, the tool, your device sheet and the test result will be filled in for you.