JWT decoder

Read the header and payload of a JSON Web Token. Your token never leaves this page.

Header

Payload
Signature not verified. This tool only decodes the token. Your token never leaves this page.
How it works
  1. Paste your JWT into the box.
  2. Read the header and payload, and check when the token expires.
  3. Copy either part if you need it.
Questions
Is my token sent to a server?
No. Decoding happens in your browser and your token is never sent anywhere. Even so, avoid pasting live production tokens into any tool you do not trust.
Does this verify the signature?
No. It only decodes the token. Verifying a signature needs the secret or public key, and a decoded token is not proof that it is genuine.
What are exp, iat and nbf?
They are times in seconds since 1970. exp is when the token expires, iat is when it was issued, and nbf is the time before which it must not be accepted.
Why does it say this is not a JWT?
A JWT has three parts separated by dots, and the first two must decode to JSON. A cut-off token or one with extra text around it will fail.
Can anyone read what is in my JWT?
Yes. The header and payload are only encoded, not encrypted, so never put secrets in them. That is why a decoder like this works at all.
Related tools