JWT decoder
Paste a JWT and see its header and payload pretty-printed, with exp, iat and nbf translated into real dates and a plain-language expiry status. Decoding is pure client-side JavaScript — the token is never sent anywhere, which matters because a live JWT is a credential, not a harmless string.
- Nothing you type leaves this page
- Works offline once loaded
- Free forever, no signup
Preparing JWT Decoder for you…
Loading the tool into your browser. Nothing is uploaded — the work happens on your device.
- Issued (iat) {{ result.claims.iat.local }}
- Not before (nbf) {{ result.claims.nbf.local }}
- Expires (exp) {{ result.claims.exp.local }}
Verifying a signature needs the issuer's secret or public key, which this tool never asks for. Both the header and payload above are readable by anyone who has the token — a JWT signature proves the claims weren't tampered with, it does not hide them.
How to use this tool
-
Paste your JWT
Decoding happens instantly as you type — there is no submit button and no request is ever sent.
-
Read the header and payload
Both are pretty-printed JSON, with exp/iat/nbf shown as local dates alongside the raw claim.
-
Check the expiry badge
A single line tells you whether the token is currently valid, already expired, or has no expiry at all.
Questions people ask
Is it safe to paste a JWT into an online decoder?
A live JWT is a credential — pasting one into most online tools is a real risk, since some of them log or transmit what you paste. This tool never makes a network request while decoding; open your browser's DevTools Network tab and paste a token to confirm nothing fires.
Does this tool verify the signature?
No, and it never will by design. Verifying a signature needs the issuer's secret or public key, which this tool never asks for. It decodes the header and payload only — both are readable by anyone with the token, signature or not.
What is inside a JWT?
Three base64url-encoded, dot-separated parts: a header describing the algorithm, a payload holding the claims (subject, expiry, custom data), and a signature. The header and payload are never encrypted, only encoded — a JWT hides nothing from anyone who has it.
How do I check when my JWT expires?
Paste it above — the exp claim, if present, is converted to your local time and paired with a plain-English status: "Expires in 2h" or "Expired 3d ago". A token with no exp claim never expires on its own.
Why does decoding fail with a "three parts" error?
A JWT is always header.payload.signature — exactly two dots. That error means what you pasted has been truncated, has extra whitespace mixed in, or was never a JWT (an API key or session cookie, for example) in the first place.
Does decoding a JWT expose a password?
No — JWT payloads hold claims (user ID, roles, expiry), not passwords. Still, treat a live, unexpired token like a key: anyone who has the raw string can use it to authenticate as you until it expires.
Related tools
- Base64 Encode/Decode Encode text or files to Base64 and decode Base64 back to text, entirely in your browser. UTF-8 s...
- Hash Generator Generate SHA-1, SHA-256, SHA-384 and SHA-512 hashes of any text in your browser using the Web Cr...
- URL Encoder/Decoder Percent-encode or decode text and URLs in your browser, plus a query-string parameter table view...
Bookmark this page — the tool keeps working offline, and your settings stay in this browser. Built by Dynamb Technologies, who make software for a living.