Decode and inspect JSON Web Tokens. View header, payload, and expiration. No tokens ever leave your browser.
Decode JSON Web Tokens (JWT) online instantly. Inspect header, payload, expiration and issue date. Safe, runs fully in your browser, your tokens never leave your device.
Yes. The decoder runs entirely in your browser; your token is never sent to our servers or anywhere else. That said, you should still be cautious about pasting production tokens on any website. For sensitive tokens, disconnect from the network first.
The header declares the token type and signing algorithm. The payload contains claims, user identity, permissions, expiration. The signature is a cryptographic proof that the header and payload have not been tampered with, generated using a secret or private key.
This decoder only reads the token; it cannot verify signatures because that requires the issuer's secret or public key. Verification must happen server-side using a library like jsonwebtoken (Node) or equivalent in your stack.
Those are Unix timestamps in seconds. 'iat' is when the token was issued, 'exp' when it expires, 'nbf' the earliest time it becomes valid. This tool converts them into human-readable dates automatically.