JWT Decoder
The JWT decoder reads a JSON Web Token and shows its header and payload as formatted JSON. It converts the exp, iat and nbf claims into readable dates and tells you whether the token has expired. Decoding happens in your browser, so the token never leaves your device.
How a JWT is built
A JSON Web Token has three parts separated by dots: a header, a payload and a signature. The header and payload are JSON objects encoded with base64url, which is why anyone can read them. The signature proves the token was not altered, but it needs the secret or public key to check.
| Claim | Meaning |
|---|---|
| iss | Issuer of the token |
| sub | Subject, usually a user ID |
| aud | Intended audience |
| exp | Expiry time (Unix seconds) |
| nbf | Not valid before this time |
| iat | Issued-at time |
Questions people ask
Is it safe to decode a JWT online?
It is safe here because decoding runs in your browser and nothing is sent. Still, treat live tokens like passwords and prefer test tokens.
Why can I read the payload without a key?
The payload is only encoded, not encrypted. Never put secrets such as passwords in a JWT payload.
What do the dates mean?
exp, iat and nbf are Unix timestamps in seconds. The tool converts them to UTC and your local time.