JWT decoder
Paste a JSON Web Token to read its header and payload, and see exactly when it was issued and when it expires.
Decoding happens in your browser. The token is never sent anywhere.
Not expired. Expires 11/27/2026, 5:30:00 AM (2026-11-27T00:00:00Z).
{
"alg": "HS256",
"typ": "JWT"
}{
"sub": "user_42",
"name": "Crunch Cube",
"role": "editor",
"iat": 1795132800,
"exp": 1795737600
}Issued at iat | 11/20/2026, 5:30:00 AM (2026-11-20T00:00:00Z) |
|---|---|
Expires at exp | 11/27/2026, 5:30:00 AM (2026-11-27T00:00:00Z) |
The signature isn't verified here. Decoding shows what a token says; only your server, with the secret or public key, can prove it's genuine.
What's inside a JWT
A JWT is three base64url strings joined by dots: a header saying how it was signed, a payload with the claims (who the user is, when the token expires), and a signature that proves nobody changed the first two.
Because the payload is only encoded, never put secrets in it. Anyone holding the token can read it, exactly as this page does.
The times inside are Unix timestamps. Convert any of them with the Unix timestamp converter.
Frequently asked questions
Is it safe to paste a real token here?
Decoding runs only in your browser and nothing is sent anywhere. Still, treat live production tokens like passwords and avoid pasting them into any website you don't trust.
Does this verify the signature?
No. Anyone can decode a JWT's header and payload because they're only base64url-encoded, not encrypted. Verifying the signature needs the secret or public key, which belongs on your server.
What do iat, nbf and exp mean?
iat is when the token was issued, nbf is the time before which it must not be accepted, and exp is when it expires. All three are Unix timestamps in seconds.
New games, tools and tutorials
About one short email a week. No spam, one-click unsubscribe.