JWT Decoder
Paste a token, get the header and payload as JSON, plus iat/exp/nbf in your local timezone. Decode only — this page never checks the signature.
Tool input stays in your browserDid you know · Networking
QUIC runs over UDP and powers HTTP/3, cutting the round trips a connection needs before sending data.
Decode only — the signature is never verified.
Token
you edit—Header
read onlyPayload
read onlySignature
read onlynot verifiedNo signature (unsecured token, two parts).
Decode is not verify
A JWT is three Base64url segments: header, payload, and signature. Anyone can read the first two without a secret. Checking the third requires the HMAC key or the issuer's public key, which this page does not have and will not ask for. The banner that says not verified is the point: a decoded payload is not proof that the token is authentic or that the claims are still valid on the server that issued it.
A leading Bearer is stripped, and whitespace inside the token is ignored, so you can paste from an Authorization header or a folded log line.
Time claims
iat, exp, and nbf are shown as local time and ISO-8601. The spec uses seconds since the Unix epoch; if a value looks like milliseconds (thirteen digits), it is treated as milliseconds so the clock is still readable. Expired and Not yet valid compare those instants to your browser clock. They still do not mean the token was signed correctly.
Why it is private
Splitting and decoding run as JavaScript inside this page. Open DevTools, switch to the Network tab, and paste a session token: no request carries the token. That matters because people paste live access tokens here.
JWT decoder FAQ
Decode JWT online, inspect header and payload, exp/iat/nbf, and why this JWT decoder does not verify signatures.
What is a JWT decoder?
A JWT decoder splits a JSON Web Token into header, payload, and signature and shows the JSON claims. This JWT decoder pretty-prints header and payload and converts iat, exp, and nbf to local time. It does not verify the signature and must not be used as “this token is valid.”
How do I decode a JWT online?
Paste the token (with or without the Bearer prefix) into this JWT decode tool. Three base64url parts are expected. The payload is JSON you can copy. Decoding is local; the token is never sent to a server.
Does this JWT decoder verify signatures?
No. Verification needs the secret or public key and is easy to misread as authentication. This page is an inspector only: header, payload, and expiry banners against this browser’s clock.
What do exp, iat, and nbf mean in a JWT?
iat is issued-at, exp is expiry, nbf is not-before. They are Unix times, usually in seconds. A 13-digit number is treated as milliseconds. This JWT payload inspector shows those claims in your local timezone.
Is it safe to paste a Bearer token here?
Safer than a site that uploads it: this JWT decoder runs in your browser. Still treat access tokens as secrets; prefer expired samples when you can. Open the Network tab to confirm no request carries the token.