JWT Decoder
Read the header and payload of a JWT and interpret its timestamps, without the token leaving your browser.
EncodingWhat a JWT is
A JSON Web Token has three parts separated by dots: header, payload and signature. The first two are JSON encoded in URL-safe Base64 — readable by anyone, not encrypted. The third is the signature, which lets whoever holds the key verify that the first two have not been altered.
The payload is not secret
This is the most common misunderstanding. A JWT hides nothing: anyone who intercepts it can read its contents without any key, exactly as this tool does. The payload should therefore never carry confidential data — only what you are willing to show to whoever holds the token.
The timestamps, which is why you are here
The exp, iat and nbf claims are seconds
since 1 January 1970: unreadable at a glance, and exactly what you go looking
for when a token "stopped working". They are shown here in readable form too,
with how long remains before expiry or how long ago it passed.
Why the signature is not verified
Verifying it would require the key — the secret that must not circulate. Pasting it into an online tool would defeat the security of the whole system. A token decoded without verification therefore tells you what it claims, not whether those claims are genuine. For verification, use a library inside your own code, where the key already lives.
Frequently asked questions
No, never. Decoding happens entirely in your browser. It is the only acceptable design for a tool like this: a token is a valid credential, and transmitting it would be handing over access.
No, deliberately. It would require the secret key, which should never be pasted into an online tool. Verification belongs in your own code, using a library, where the key already lives.
No. The payload is only encoded, not encrypted: anyone who intercepts the token can read it. Treat it as public information.