A JSON Web Token (JWT) is a compact, URL-safe token format used for securely transmitting information between parties. It consists of three Base64URL-encoded parts — header, payload, and signature — separated by dots.

How do I decode a JWT token?

Paste your JWT into the input field and click "Decode JWT". The tool splits the token by dots, Base64URL-decodes each part, and displays the header and payload as formatted JSON.

Is the JWT signature verified?

No. This tool only decodes the header and payload — it does not verify the signature. Signature verification requires the secret key or public key and must be done server-side.

Is it safe to paste my JWT here?

Yes. This tool runs entirely in your browser — no data is sent to any server. Your token never leaves your device.

What are the exp, iat, and nbf claims in a JWT?

These are registered JWT claims: "exp" (expiration time) defines when the token expires, "iat" (issued at) records when it was issued, and "nbf" (not before) defines when the token becomes valid. All are Unix timestamps.

Free Tool

JWT Decoder

Decode JSON Web Tokens instantly. View the header, payload claims, expiry status, and time fields — all in your browser. No data sent to any server.

Paste Your JWT Token

Note: This tool only decodes the header and payload — it does not verify the signature. Never trust a JWT's claims without server-side signature verification.