JWT Decoder
Paste a JWT and see what is inside: the header, the payload and when it was issued and expires. The token never leaves this page.
The token is read in this page only. It is not sent anywhere and its signature is not checked.
The header and payload appear here.
Questions
What is inside a JWT?
Three parts separated by dots: a header that says how it was signed, a payload with claims such as who it is for and when it expires, and a signature.
Does this check the signature?
No. Verifying a signature needs the secret or public key, and it should happen on your server. This tool only reads what the token says.
Is it safe to paste a real token here?
The token is decoded in your browser and not sent anywhere, so it never reaches us. Still, treat live tokens like passwords: prefer test tokens, and avoid pasting production tokens anywhere you do not need to.
What do exp, iat and nbf mean?
exp is when the token expires, iat when it was issued and nbf the time before which it must not be accepted. They are Unix times, which the tool shows as dates.
Can anyone read my token's payload?
Yes. The payload is only encoded, not encrypted, so do not put secrets in it.
More free tools
Made by Bulb Studio, a design and development studio in Kolkata.