JWT Decoder
Decode JSON Web Tokens online: split header / payload / signature, resolve exp, iat and nbf to dates with expiry status — all local.
Decoding is not verifying — this tool never checks the signature. Never paste production secrets into tools you don’t control.
Paste a token to decode it.
What is Jwt Decoder
Paste a JWT to split and inspect its header, payload and signature locally: JSON is pretty-printed, exp/iat/nbf resolve to readable dates with an expired/valid status, and alg=none is flagged.
How to use Jwt Decoder
- Paste the full token (three dot-separated segments) into the input
- Inspect alg/typ in the header and claims in the payload
- The signature is shown raw only — use a trusted backend or key to actually verify it
Frequently asked questions
Does decoding a JWT verify it?
No. The payload is just base64url-encoded JSON that anyone can decode or forge. Verification requires the secret or public key and the signing algorithm (HS256, RS256, …). This tool parses only — never treat "decodable" as "trustworthy".
What are exp, iat and nbf?
Standard time claims in Unix seconds: iat = issued at, nbf = not valid before, exp = expires at. The tool converts them to UTC dates and computes the expiry state relative to now.
Why warn against pasting production tokens?
A JWT can carry identity and permission claims — leaking it can leak a session. This tool runs entirely in your browser and sends nothing anywhere, but keeping production tokens out of web pages is still the safe habit.
Is Jwt Decoder free?
Jwt Decoder is completely free — open the page and use every feature with no hidden charges.
Do I need to download or install Jwt Decoder?
No download or installation is needed. It is an online tool that runs in the browser on your phone, tablet and computer.
Do I need an account to use Jwt Decoder?
No. Use the tool right away — no account or sign-in required.
Does Jwt Decoder work on mobile?
Yes. The page is fully responsive and works on phones, tablets and desktop browsers.