Developer & Web Tools
JWT Decoder
Decode a JSON Web Token to inspect its header, payload and expiry. Runs entirely in your browser.
Privacy
Everything on this page runs inside your browser. Nothing you paste, type or upload is transmitted, logged or stored.
Tips
- A JWT is signed, not encrypted. Anyone holding the token can read the payload, so never put secrets in it.
- iat, exp and nbf are seconds since 1970 UTC, not milliseconds — a common off-by-1000 bug.
- Signature verification needs the secret or public key and must happen on your server, never in a browser.
Frequently asked questions
Is it safe to paste a real token here?
Decoding happens entirely in your browser and nothing is transmitted or stored. That said, a live token is a live credential — prefer an expired or test token, and rotate anything you paste into any online tool.