JWT Decoder
Paste a JWT to see its decoded header and payload, plus human-readable exp/iat/nbf timestamps.
Header
Payload
Signature
Not verified — verifying a signature requires the secret/public key, which this tool never asks for.
This tool never verifies a signature
Verifying a JWT's signature requires the issuer's secret or public key — a tool that asked you to paste that
in would be teaching a bad security habit. This decoder only splits the token and decodes the header/payload
JSON, exactly like jwt.io's "decode" view.
How it works
A JWT is three Base64URL-encoded segments joined by dots: header.payload.signature. This tool
decodes the header and payload segments (each a small JSON object) and parses standard time claims —
iat (issued at), exp (expires), and nbf (not before) — into
human-readable timestamps, flagging the token as expired if exp is in the past.