What a JWT is
A JSON Web Token is three Base64URL segments — header, payload, signature — separated by periods. The header and payload are plain, readable JSON once decoded; only the signature requires a key.
JWT Decoder — Inspect Header and Claims
Decode a JWT's header and payload and inspect standard claims like exp and iat directly in your browser. Decoding does not verify the signature.
English
0 chars
Decoded, not verified — anyone can read a JWT's contents without a key. Use the Verify tab to check the signature.
Processed locally. Tokens, keys, and secrets never leave this device.JWT · decode
Reading the claims table
exp, nbf, and iat are Unix timestamps in seconds. Expired and not-yet-valid claims are flagged automatically, but every other claim is exactly what the token's issuer put there — nothing here vouches for it.
Never paste tokens into a site that uploads them
A JWT often carries session or API authority. Decoding here happens entirely in your browser; a tool that sends your token to a server for "decoding" can log or replay it.