{}DevTools Kit

JWT Decoder

Decode a JSON Web Token (JWT) to read its header and payload, with human-readable expiry and issued-at times. Runs entirely in your browser.

// jwt○ ready
Token

About this JWT decoder

A JSON Web Token (JWT) has three Base64url parts separated by dots: a header, a payload of claims, and a signature. This decoder reads the header and payload so you can inspect what a token contains — the algorithm, the subject, and the issued-at and expiry times — and tells you whether it has expired.

A note on security

This tool only decodes — it never verifies signatures and never asks for your secret. A JWT payload is not encrypted, so treat any token as sensitive and only verify it on your server.

Frequently asked questions

Does this verify the JWT signature?
No. It decodes the header and payload so you can read them, but it does not verify the signature — that requires the secret or public key, which you should never paste into a website. Always verify signatures server-side.
Is my token sent to a server?
No. Decoding happens entirely in your browser, so the token never leaves your device.
How does it show expiry?
Standard time claims (exp, iat, nbf) are numbers of seconds since the Unix epoch. The decoder converts them to readable UTC dates and flags whether the token has expired.

// More tools