tools ▸ jwt decoder

Decode a JWT,safely.

Paste a token to see its header, claims and expiry in readable form. Decoding happens entirely in your browser — the token is never transmitted.

JSON Web Token

Header

Payload

runs 100% in your browser — nothing is uploaded or stored

jwt decoder ▸ explained

What you need
to know.

Decode a JSON Web Token header and payload, and see issued/expiry times — locally.

Host your API on a VPS

header

Algorithm & type

Shows the signing algorithm (HS256, RS256…) and key ID.

payload

The claims

sub, iss, aud, exp and custom claims — with timestamps converted to IST and UTC.

signature

Not verified here

Decoding is not verification. Always verify the signature on your server.

related ▸ more free tools

Keep going.

Base64 Encoder / Decoder Encode text or files to Base64 and decode Base64 back — UTF-8 and URL-safe supported. Open tool Hash Generator Generate MD5, SHA-1, SHA-256, SHA-384, SHA-512 and CRC32 hashes of text or files. Open tool UUID Generator Generate UUID v4 (random) and v7 (time-ordered) identifiers in bulk. Open tool URL Encoder / Decoder Percent-encode text for safe use in URLs and query strings, or decode encoded URLs. Open tool

All 42 free tools →

faq ▸ before you buy

JWT Decoder — FAQ

Is it safe to paste my JWT here?+

The token is decoded with JavaScript in your browser and never sent to a server. Still, avoid pasting live production tokens anywhere you don't control.

Does this verify the signature?+

No — it only decodes. Signature verification needs the secret or public key and should happen on your backend.

Why is my JWT "expired"?+

The exp claim is in the past. We compare it with your device's clock and show how long ago it expired.

Your site could be live
before this page scrolls.

Get started Talk to us first

~$ provision --region in ✓ done in 47s