About the JWT Decoder
A JSON Web Token (JWT) is three Base64URL-encoded parts separated by dots: a header, a payload of claims, and a signature. Paste a token here to see the header and payload as readable JSON and to check whether it has expired. The token is decoded locally and never leaves your browser.
How to use it
- Paste the full token (the three parts joined by dots) into the Token box.
- Read the decoded Header and Payload.
- Check the expiry badge, which compares the exp claim with the current time.
- Copy any section you need.
Features
- Decodes header and payload into formatted JSON
- Shows the raw signature segment
- Reads the exp claim and tells you whether the token has expired
- Clear error when the token is not three dot-separated parts or is not valid Base64URL JSON
- Decoding happens in your browser, so tokens are not uploaded
Frequently asked questions
- Does this verify the token's signature?
- No. This tool only decodes the token so you can read it. Decoding is not verification: anyone can read a JWT's contents, and only your server, holding the secret or public key, can tell whether the signature is genuine.
- Is it safe to paste a real token?
- The decoding runs in your browser and nothing is sent to a server. Even so, treat live production tokens as secrets and prefer a test or expired token when you can.
- What do the exp, iat and nbf claims mean?
- They are Unix timestamps in seconds: exp is when the token expires, iat is when it was issued and nbf is the earliest time it is valid. This tool uses exp to show whether the token is still valid.
Part of Octodius' free developer tools. Everything here runs in your browser.
