How do I decode a JWT?

Paste the token into the box. The header and payload are decoded from base64url and shown as formatted JSON. A leading "Bearer " is ignored.

Does it verify the signature?

No. Decoding only reads the contents, which anyone can do. To trust a token, your server must verify the signature with the right key.

How do I tell if a token has expired?

The exp claim is a Unix timestamp in seconds. The tool shows exp, iat and nbf as dates and says whether the token has expired.

Is it safe to paste a real token?

The token is decoded in your browser and not sent anywhere. Even so, treat live tokens as passwords and prefer expired or test tokens.

JWT Decoder

Decode a JSON Web Token in your browser to read its header and payload, with exp, iat and nbf shown as dates and whether it has expired.

How to use it

Paste a JWT (a leading "Bearer " is fine) to see its header and payload as formatted JSON. The signature is not verified, so do not trust the contents on their own.

About this tool

A JWT is three base64url parts separated by dots: a header, a payload and a signature. This tool decodes the first two so you can read them. It does not check the signature.

Frequently asked questions

How do I decode a JWT?: Paste the token into the box. The header and payload are decoded from base64url and shown as formatted JSON. A leading "Bearer " is ignored.
Does it verify the signature?: No. Decoding only reads the contents, which anyone can do. To trust a token, your server must verify the signature with the right key.
How do I tell if a token has expired?: The exp claim is a Unix timestamp in seconds. The tool shows exp, iat and nbf as dates and says whether the token has expired.
Is it safe to paste a real token?: The token is decoded in your browser and not sent anywhere. Even so, treat live tokens as passwords and prefer expired or test tokens.