JWT Decoder
Paste a JSON Web Token to inspect its header and payload, with expiry claims translated into readable local dates and a live valid / expired badge.
Decoding only - the signature is NOT verified. A JWT's header and payload are just Base64URL-encoded JSON that anyone can read; this tool never checks whether the signature is genuine, so never treat a token as trusted because it "decodes fine". And because JWTs are credentials: never paste production tokens or secrets you don't own into any web tool. This page runs 100% in your browser and sends nothing anywhere, but the habit matters.
Header
-
Payload
-
Time claims
| Claim | Raw value | Local time | Status |
|---|
Claim cheat-sheet:
exp is when the token stops being accepted, iat is when it was issued, and nbf ("not before") is the earliest moment it may be used. All three are Unix timestamps in seconds. The badge above turns red once exp is in the past and amber if nbf is still in the future. The sample token prefilled on load was generated locally by this page just for demonstration; its signature is fake.