JWT Decoder
Decode a JSON Web Token and read its header, payload and expiry.
JSON Web Token
Private by design. Tokens are decoded in your browser and never transmitted. Even so, treat any token you paste anywhere as compromised and rotate it if it is a production credential.
How to use the JWT Decoder
- Paste the token: three base64url segments separated by dots.
- Read the header for the algorithm and key id, and the payload for the claims.
- Check the status line —
iat,nbfandexpare rendered as dates in your timezone, with a live countdown to expiry. - Copy either segment as formatted JSON.
A worked example
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9…
{ "alg": "HS256", "typ": "JWT" }That first segment is the header of every HS256 token, and it decodes without any key at all — which is the point worth internalising: a JWT is signed, not encrypted.
Frequently asked questions
What is a JWT decoder?
It splits a JSON Web Token into its header and payload segments and base64url-decodes them so you can read the claims. The signature segment is shown but not interpreted.
Does this tool verify the JWT signature?
No, and that is intentional. Verification needs the signing secret or public key, and you should never paste those into a website. Verify signatures in your own backend or with a local CLI.
Is it safe to paste a token here?
Decoding happens entirely in your browser with no network request. That said, any token pasted into any tool should be considered exposed. Use expired or test tokens where you can.
Why does my token show as expired?
The exp claim is a Unix timestamp in seconds. The tool compares it against your device clock, so a wrong system time on your machine can also make a valid token look expired.
About the JWT Decoder
A JSON Web Token is three base64url segments separated by dots: header, payload and signature. The first two are encoded, not encrypted, so anyone holding the token can read them. This decoder splits the token, decodes both segments and renders the standard time claims (iat, nbf, exp) as human dates alongside a live expiry countdown.
Signature verification is deliberately not offered. Verifying requires the signing secret or public key, and pasting a production signing key into a web page is exactly the habit this tool should not encourage.
Maintained by Ikonode. Last checked against the code on 11 September 2026.
What it does not do
- The signature is displayed but never verified. Verifying needs your signing key, which should not be pasted into any web page.
- Encrypted tokens (JWE, five segments) are not decoded — only the signed JWS form.
- Decoding is not validation: a forged or expired token still shows its claims.