JWT Decoder — Read Header and Payload Claims
Decode the Base64URL JSON header and payload of a JSON Web Token and render common time claims in UTC.
Loading the tool… JavaScript is required for processing on your device. The instructions and examples below are available without JavaScript.
How to use it
Paste a JWT to read its header, claims, and expiry time.
Good to know
Decoding does not verify the signature. Never trust a token’s claims without verifying it on your server.
Inspect a test token’s visible claims
Paste a three-part JWT to view its header and payload. The bundled example shows alg: HS256, name: Ada, an issued time of 2024-01-01T00:00:00Z, and an expiry time of 2024-01-01T01:00:00Z. This helps debug the values a token carries.
Decoding is not verification
Anyone who has a token can decode its header and payload; neither part is confidential by itself. This page does not validate the signature, issuer, audience, time against a trusted clock, or authorization policy. Do not accept a token’s claims because they look plausible here, and avoid pasting production credentials where a test token will do.
Frequently asked questions
Is it safe to paste a JWT here?
The token is decoded in your browser and never uploaded. Still, treat production tokens like passwords and prefer test tokens.
Does decoding a JWT verify it?
No. Anyone can read a JWT payload. Only signature verification with the secret or public key proves it is genuine.
How do I check when a JWT expires?
The exp claim is a Unix timestamp. This tool converts exp, iat, and nbf into readable UTC dates.