JWT decoder
Read the header, payload and expiry of a token.
This tool is temporarily unavailable.
Decoded locally in your browser. The token is never sent anywhere.
How it works
- 1
Paste the token
Paste a JWT, with or without the “Bearer” prefix.
- 2
Read the claims
See the header, the payload and whether the token has expired.
- 3
Verify elsewhere
Check the signature on your server with the secret or public key; this page only decodes.
Questions and answers
Is it safe to paste a real token?
The token is decoded entirely in your browser and never leaves it. Still, treat live tokens as passwords and prefer test tokens.
Does it verify the signature?
No. It only decodes the header and payload. A decoded token is not proof that it is genuine.
What do iat, nbf and exp mean?
Issued at, not valid before and expiration time, all as Unix timestamps. We show them as local dates and flag expired tokens.
Why does it say the token has no signature?
Tokens with alg none or an empty third part are unsigned and must never be accepted for authentication.