JWT Decoder
Decode a token to read its claims and expiry, or encode your own header and payload into an unsigned one. Both run in the browser; no key is ever requested.
Decoded locally in your browser. This tool never asks for a key and never verifies the signature — decoding a token is not the same as trusting it.
Both fields must be JSON objects. The token comes out unsigned: sign it wherever your key already lives.
When you need this
- A request fails with 401 and you need to know whether the token is expired, not yet valid, or simply signed by someone else.
- You are debugging an integration and want the exact
expandiatvalues as human dates instead of two ten-digit numbers. - A token looks suspicious and you want to read its
algand claims before sending it to anyone. - You need to confirm what a third-party login actually put in the payload — an email, a role, a tenant id.
Why other JWT decoders fall short
Many decoders ask for the secret so they can "verify" the token. Pasting a production signing key into a web page is the single worst thing you can do with a JWT, and a tool that invites it is not helping you.
Decoders that print the raw JSON without touching exp leave you to convert epoch seconds by hand — which is exactly the step people get wrong when a token expires.
Some show a green checkmark for "valid" when all they did was parse the base64. A parsed token proves nothing; only signature verification does, and that needs the key.
Frequently asked questions
Does this verify the signature?
No, and it never will. Verification needs the signing key (HS) or the public key (RS/ES*), and asking you to paste either one into a web page would create a worse problem than the one you came here to solve. The tool decodes and reports; the verification has to happen where the key already lives.
Is it safe to paste a real token here?
The decoding happens in your browser and there is no upload. That said, a JWT is a bearer credential: anyone holding it can act as that user until it expires. Treat pasting one into any page — including this one — the way you would treat pasting a password, and prefer a test token when you can.
What do exp, iat and nbf mean?
exp is when the token stops being valid, iat is when it was issued, nbf is the earliest moment it may be used. All three are Unix seconds. Only exp implies expiry; nbf in the future means the token is not active yet, which is a different failure.
Why does my token have no exp?
Because the issuer chose not to set one. Such a token does not expire on its own — it stays valid until the server decides otherwise (a revocation list, a short session store, or nothing at all). If you are the issuer, that is usually a bug rather than a design.