The result appears here.
Free tool · runs in your browser
JWT decoder
Paste a JSON Web Token to read its header and payload as formatted JSON, with exp, nbf and iat shown as dates and a warning when it has expired. The signature is not checked.
Decode, not verify
Anyone can read a JWT's header and payload, and this tool does just that. It does not check the signature, so it can't tell you whether a token is genuine.
Stays on your device
Tokens are decoded in your browser and never sent anywhere. Still, treat live tokens like passwords.
Dates you can read
exp, nbf and iat are shown in UTC with how long ago or from now, and an expired token is flagged.
Shortcuts
- Ctrl/⌘ Enter
- Format
- Ctrl/⌘ Shift M
- Minify
- Ctrl/⌘ F
- Find in the editor
- Ctrl/⌘ Alt [
- Fold all
Questions
Does it verify the signature?
No. It decodes the header and payload, which are only base64url-encoded, not encrypted. Verifying needs the secret or public key and should happen on your server.
Is it safe to paste a token here?
The token is decoded in your browser and not uploaded or stored. A live token still grants access to whoever holds it, so don't paste it into tools you don't trust, and prefer expired or test tokens.
What about encrypted tokens?
Encrypted JWTs (JWE, five parts) can't be read without the key, and the tool says so.
Can I paste the whole Authorization header?
Yes. A leading "Bearer " is ignored.