Home›Developer Tools› JWT decoderBrowser
Decode a JSON Web Token
Decodes the header and payload of a JWT and converts the exp, iat and nbf claims into readable dates. The signature is not verified — that requires the signing key, which should never be pasted into a web page.
How to use it
- 1Paste the token — header.payload.signature — into the input box.
- 2The header and the payload are decoded and shown as formatted JSON.
- 3Read exp, iat and nbf as dates rather than as Unix timestamps.
Frequently asked questions
- Is the signature verified?
- No, and that is deliberate. Verifying needs the signing key, and a signing key should never be pasted into a web page. This decodes and reads a token; it does not tell you whether the token is trustworthy.
- Is it safe to paste a real token here?
- The decoding happens in your browser and nothing is transmitted, so the token does not leave your device. Treat any token you have shared elsewhere as compromised regardless, and prefer an expired one when you just want to inspect the structure.
- What do exp, iat and nbf mean?
- Expiry, issued-at and not-before, all of them Unix timestamps in seconds. They are shown here as readable dates because comparing 1735689600 against the current time in your head is where the mistakes come from.
- Why is my token rejected as undecodable?
- Usually a copy that lost a character, or a token that is not a JWT at all — an opaque session identifier looks similar but has no structure to decode. A JWT has at least two dot-separated Base64URL parts, and the first one parses as JSON.
- Is the payload encrypted?
- No. A signed JWT is Base64URL-encoded, not encrypted: anyone holding the token can read every claim in it, as this page demonstrates. The signature stops tampering; it does not provide secrecy. Never put anything private in a payload.