JWT Decoder
Decode JSON Web Tokens locally to read the header and payload, check exp, nbf and iat times and spot expired tokens. Your token is never transmitted, which makes it safe for production credentials.
Runs locally · nothing uploaded
How to use the JWT Decoder
- 1
Paste a JWT (a leading “Bearer ” is fine).
- 2
Read the decoded header and payload as formatted JSON.
- 3
Check the issued-at, not-before and expiry times and the token's current status.
What happens to your data
Tokens are decoded with JavaScript in your browser. They are not sent, logged or stored.
Frequently asked questions
Is it safe to paste a production token?
The token is decoded in your browser and never transmitted. Even so, treat live tokens as secrets and revoke any you have shared elsewhere.
Does this verify the signature?
No. Verifying needs your secret or public key, which this page deliberately never asks for. It only decodes the token.
What does alg “none” mean?
The token is unsigned. A server should never trust such a token; the decoder warns you when it sees one.