JWT Decoder
Paste a JWT to see its header, its claims and whether it has expired. The token stays in your browser - this page has no server to send it to, and never asks for your signing key.
Claims explained, not just dumped
The registered claims are rendered for humans: `exp`, `iat` and `nbf` become ISO timestamps with a relative reading such as "in 2 hours" or "3 days ago", and an expired token is flagged clearly. `iss`, `sub`, `aud` and `jti` are listed alongside the raw JSON payload so you can see both views at once.
The signature is not verified - on purpose
Verifying a signature requires the shared secret or the public key. A site that asks you to paste a secret is asking for the one thing that must never leave your infrastructure. This tool decodes only. Verify signatures in your own code or CLI, where the key already lives.
What a decoded token can and cannot tell you
Decoding proves what the token claims, not that the claims are true - anyone can craft a token with any payload. Treat the output as a debugging aid: use it to confirm which user, scope or expiry a token carries while chasing a 401, and rely on server-side verification for trust decisions.
Frequently asked questions
Is my token sent to a server?
No. Nothing you paste leaves your browser. The page loads a small amount of JavaScript, and every calculation happens on your own machine - there is no server to send data to. A JWT is a live credential: anyone holding it can act as the user until it expires, so pasting one into a site that transmits it would be a real incident. This page cannot transmit it.
Why do you not verify the signature?
Because verification needs your secret or public key, and no third-party page should ever receive it. Decoding shows the contents; verification belongs where the key is - your backend, or a local CLI such as `jwt` or a small script using your language's JWT library.
What does "expired" mean here?
The `exp` claim is a Unix timestamp in seconds. The token is shown as expired when that instant is in the past according to your device's clock. If your clock is wrong, the verdict will be too - and so will the verdict of any server with a wrong clock, which is a common cause of mysterious 401s.
Is a JWT encrypted?
A standard signed JWT (JWS) is not. The header and payload are Base64URL-encoded, which is readable by anyone who has the token. The signature prevents tampering, not reading. Never put anything confidential in a JWT payload; if you need secrecy, use an encrypted JWE instead.