JWT decoder
Paste a JSON Web Token to read its header and claims, and to see when it was issued and when it expires.
How it works
A JWT is three parts joined by dots: header.payload.signature. The first two are JSON encoded with Base64URL; the decoder reverses that. Times (exp, iat, nbf) are Unix timestamps in seconds and are shown as dates.
Frequently asked questions
Is it safe to paste a token here?
The token is decoded in your browser and is not sent anywhere or put into the page link. Still, a live token is a working password until it expires: prefer expired or test tokens.
Can anyone read a JWT?
Yes. The header and payload are only Base64URL-encoded, not encrypted. The signature stops a token from being changed, not from being read, so never put secrets in a JWT.
Does this verify the signature?
No. Checking the signature needs the secret or public key and belongs on your server. This page shows what the token claims, which is enough to debug expiry, audience and scope problems.