JWT Decoder — Decode Tokens Offline
Paste a JSON Web Token to read its header, payload and timing claims. Everything is decoded on your own device, so the token never travels across the network.
Three quick steps
1 · Paste
Drop the token into the left pane. It is parsed instantly, on your device.
2 · Read
See the header and payload as formatted JSON, with issue and expiry times spelled out.
3 · Check
The status line tells you whether the token is still inside its validity window.
About JWTs
Is my token sent anywhere?
No. Decoding happens entirely in your browser and the page makes no network request with your token. You can disconnect from the internet and it still works.
Can this verify the signature?
No, and no browser tool honestly can. Verifying a signature needs the issuer’s secret or public key, which you should never paste into a web page.
Should I paste a production token here?
Prefer a test token. Anything decoded is only in your own browser, but a token is a live credential, so rotating it after debugging is good practice regardless of the tool.
What do exp, iat and nbf mean?
They are the expiry time, the time the token was issued, and the earliest time it may be used. All three are Unix timestamps, shown here as readable dates.
Why is a JWT not encrypted?
A standard JWT is signed, not encrypted, so anyone holding it can read the payload. That is why tokens should never carry secrets.