Free JWT Decoder & Viewer

Paste a JSON Web Token to decode its header and payload, with expiry and issued-at times.

Header
{
  "alg": "HS256",
  "typ": "JWT"
}
Payload
{
  "sub": "1234567890",
  "name": "John Doe",
  "iat": 1516239022
}
Time claims
iatIssued at2018-01-18T01:30:22.000Z

The signature is shown but not verified — decoding a JWT does not require the signing key.

How to use / FAQ

Paste a JSON Web Token and its header and payload are decoded instantly, with the standard iat, nbf, and exp claims translated into readable dates and an expiry status. Use the sample button to see the format in action.

Does this verify the token's signature?

No. Decoding only reveals the header and payload, which anyone holding the token can read. Verifying the signature requires the secret or public key and should be done server-side.

Is it safe to paste a real token here?

Decoding happens entirely in your browser — the token is never sent anywhere. Still, treat any live token as a credential and avoid sharing your screen while it's on the page.

What do exp, iat, and nbf mean?

exp is when the token expires, iat is when it was issued, and nbf is the earliest time it's valid. All three are Unix timestamps, shown here as UTC dates.

Which token types and algorithms work?

Any standard JWS in header.payload.signature form decodes here regardless of algorithm (HS256, RS256, ES256, and so on), because decoding just Base64URL-decodes the first two segments. Encrypted JWEs aren't supported.