About the JWT Decoder
Paste a JSON Web Token to instantly see its header and payload as formatted JSON. Standard time claims such as exp, iat and nbf are shown as readable dates, and you can see at a glance whether the token has expired.
Everything runs locally in your browser — nothing you paste is sent to a server, so it is safe to use with API keys, tokens and private data.
How to use the JWT Decoder
- Paste your JWT.
- Read the decoded header, payload and time claims.
- Copy any part you need.
Frequently asked questions
Does this verify the signature?
No. It decodes the token so you can read it. Verifying a signature requires the secret or public key and should be done on your server.
Is it safe to paste a production token?
Decoding happens entirely in your browser and nothing is sent anywhere. Still, treat live tokens like passwords and revoke any you have shared.
What are the three parts of a JWT?
A header (algorithm and type), a payload (the claims) and a signature, each Base64URL-encoded and separated by dots.