Skip to content
Developer Runs offline

JWT Decoder

Decode a JSON Web Token and inspect its claims.

Input

0 chars

Output

0 chars
Ctrl↵

        
Questions
Is it safe to paste a real token here?
Decoding runs entirely in your browser and the token is never transmitted or stored. That said, a JWT is a live credential until it expires: prefer an expired or test token, and rotate anything you paste into any online tool, this one included.
Does this verify the signature?
No. Verification requires the signing key, and a tool that asked for your key would be a bad idea. This decoder shows you what the token claims. Only your server, holding the key, can establish whether those claims are authentic.
What do exp, iat and nbf mean?
exp is the expiry time, iat is when the token was issued, and nbf is the earliest time it may be accepted. All three are Unix timestamps in seconds. The decoder converts them to readable dates and flags a token that is expired or not yet valid.