JWT Decoder
Decode JWT headers and payloads, inspect claims and check expiry — fully offline.
Frequently Asked Questions
Is it safe to paste a JWT here?
Decoding happens 100% in your browser with JavaScript — the token never leaves your device. Still, treat tokens like passwords and avoid sharing them elsewhere.
Does this verify the signature?
No. Decoding only reads the Base64URL-encoded header and payload. Signature verification requires the secret or public key and must be done by your backend.
What does the exp claim mean?
exp is the expiry time as a Unix timestamp in seconds. The tool converts it to a readable date and tells you whether the token is expired, plus how long remains.
Why does my token fail to decode?
A valid JWT has three parts separated by dots: header.payload.signature. Each of the first two parts must be Base64URL-encoded JSON.
Related Tools
JSON Formatter
Format, validate, and beautify JSON data with syntax highlighting.
Base64 Encoder/Decoder
Encode and decode text to and from Base64 format.
Hash Generator
Generate MD5, SHA-1, SHA-256, and other hash values from text.
Timestamp Converter
Convert Unix timestamps to human-readable dates and vice versa.