JWT Decoder
Paste a JWT to see its header, payload and whether it has expired. The token is decoded locally and never uploaded.
Decoded locally. The signature is not verified because that needs your secret, which you should never paste into a website.
How it works
A JWT is three base64url segments separated by dots: header, payload and signature.
The decoder base64url-decodes the first two segments and pretty-prints them as JSON.
Standard claims like exp, iat and nbf are shown as human-readable dates with a live expired / valid indicator.
The signature is displayed but not verified, because verification requires the secret or public key, which you should never paste into a website.
Save snippets like this to your DEVAE profile and share them with collaborators. Free for individuals.
Sign up freeFrequently asked questions
No. Verifying requires the signing key. This tool only decodes, which needs no secret. Never paste production secrets into any website.
No. Decoding runs in your browser with atob. There is no network request.
Some tokens are encrypted (JWE) rather than signed (JWS). Encrypted tokens cannot be decoded without the key.
exp is the expiry as a Unix timestamp in seconds. The tool converts it to your local time and compares it to now.
