JWT Decoder

Paste a JWT to see its decoded header and payload, plus human-readable exp/iat/nbf timestamps.

Header

 

Payload

 

Signature

 

Not verified — verifying a signature requires the secret/public key, which this tool never asks for.

This tool never verifies a signature

Verifying a JWT's signature requires the issuer's secret or public key — a tool that asked you to paste that in would be teaching a bad security habit. This decoder only splits the token and decodes the header/payload JSON, exactly like jwt.io's "decode" view.

How it works

A JWT is three Base64URL-encoded segments joined by dots: header.payload.signature. This tool decodes the header and payload segments (each a small JSON object) and parses standard time claims — iat (issued at), exp (expires), and nbf (not before) — into human-readable timestamps, flagging the token as expired if exp is in the past.