JWT Decoder
Read the header and payload, and check the expiry.
About JWT Decoder
JWT Decoder reads the header and payload of a JSON Web Token, decodes the standard claims into readable dates, and tells you whether it has expired. The decoding happens in your browser — worth caring about, since a JWT often is the credential, and pasting one into a hosted debugger hands it over.
How to use it
- Paste the token.
- Read the header, payload and expiry status.
- Check the readable claims table for issuer, subject and timestamps.
Questions
Does this verify the signature?
No. It reads the token. Verifying requires the secret or public key and must happen on your server — anyone can craft a token with any payload they like, so an unverified JWT proves nothing.
Why is a JWT readable at all?
Because it is signed, not encrypted. Base64url is an encoding, so anyone holding the token can read its contents. Never put anything secret in a JWT payload.
What do exp and iat mean?
Expiry and issued-at, both Unix timestamps in seconds. The tool converts them to local dates.
JWT Decoder is free and runs entirely in your browser. No account, no upload, no watermark, no limit on use.