The JWT Decoder reveals what is inside a JSON Web Token without sending it anywhere. Paste a token and the tool splits it into its three parts, Base64URL-decodes the header and payload, and pretty-prints both as JSON. It automatically interprets the standard time claims — issued-at (iat), not-before (nbf) and expiry (exp) — as human-readable dates and warns you clearly when a token has expired. Remember that a JWT payload is only encoded, not encrypted, so anyone can read it; this tool never verifies the signature and runs entirely in your browser, so your tokens stay on your device.
How to Use the JWT Decoder
- Paste a JWT (header.payload.signature) into the input box.
- Read the decoded header and payload, formatted as JSON.
- Check the expiry status and the human-readable iat/nbf/exp dates.
Benefits and Use Cases
- Quickly inspect token claims and expiry while debugging authentication.
- Understand exactly what data an app stores in its tokens.
- Decodes locally in your browser — your token is never sent to a server.