How to use the JWT Decoder
- Paste a JWT (a “Bearer ” prefix is fine)
- Read the decoded header and payload
- Check the issued-at and expiry times
About this tool
A JWT (RFC 7519) has three Base64URL parts separated by dots: a header (algorithm and type), a payload of claims, and a signature. The header and payload are only encoded, not encrypted, so anyone holding the token can read them. Do not put secrets in a JWT payload.
This decoder does not verify signatures. That needs the signing secret or public key and should happen on your server. Everything runs locally in your browser, so tokens, keys and customer data never leave your device.
Frequently asked questions
Is it safe to paste my token here?
This page decodes locally and sends nothing, but treat live tokens like passwords: prefer expired or test tokens and never share them in public.
What do iat, nbf and exp mean?
iat is when the token was issued, nbf is when it becomes valid, and exp is when it expires. All are Unix timestamps in seconds; this tool shows them as dates.
Why can’t you verify the signature?
Verification needs the secret key (HS256) or the issuer’s public key (RS256/ES256). Do it in your backend with a maintained JWT library.
Related tools
Updated · Built and maintained by the UtilityBright team · About our tools · Report a problem