Inspect a token’s header, payload and expiry without sending it away. Free, runs entirely in your browser — your files are never uploaded.
How to use JWT Decoder
Paste the token in.
Read the decoded header and payload.
Check the expiry and issued-at times, shown as readable dates.
Frequently asked questions
Is it safe to paste a real token here?
Safer than most places, and verifiably so. Decoding happens in your browser and the Content Security Policy blocks this page from making outbound connections at all, so the token cannot be transmitted. Pasting a live token into an arbitrary online decoder is otherwise a genuine risk.
Does this verify the signature?
No. It decodes and displays the contents. Verifying requires the signing key, which belongs on your server, not in a web page.
Is the payload encrypted?
No. The header and payload are just Base64url-encoded JSON, readable by anyone holding the token. The signature proves it has not been altered; it does not keep the contents private.
How do I read the expiry?
The exp and iat claims are Unix timestamps in seconds. They are shown as readable dates so you can see at a glance whether a token has expired.