JWT Decoder
Paste a JSON Web Token to read its header and payload, and see exactly when it was issued and when it expires.
{
"alg": "HS256",
"typ": "JWT"
}{
"sub": "1234567890",
"name": "Ada Lovelace",
"role": "analyst",
"iat": 1790000000,
"exp": 1924991999
}Questions people ask
Is it safe to paste a JWT here?
The token is decoded entirely in your browser; nothing is sent to a server. Still, treat live tokens like passwords: anyone holding a valid token can act as that user until it expires.
Does this verify the signature?
No. Verifying needs the secret (HS256) or the issuer’s public key (RS256/ES256), and should happen on your server. Decoding only reads the header and payload, which are not encrypted — just Base64URL-encoded.
What do exp, iat and nbf mean?
They are registered claims from RFC 7519, given as Unix timestamps in seconds. exp is when the token expires, iat when it was issued, and nbf the time before which it must not be accepted. This decoder converts them to your local time.
Why can anyone read the payload?
A standard JWT (JWS) is signed, not encrypted. The signature proves it has not been changed, but the contents are readable by anyone. Never put secrets in a JWT payload; use JWE if you need encryption.