Skip to content
KitWren
Website

JWT Decoder

Decode a JSON Web Token’s header and payload and check its expiry — in your browser.

  1. Paste your input
  2. Choose the options
  3. Copy the output
Runs in your browser. Your data and files never leave your device.

About the JWT Decoder

Paste a JWT to read its header and claims, with timestamps (iat, exp, nbf) shown as dates and a clear expired / not expired status.

How does the JWT Decoder work?

A JSON Web Token has three parts separated by dots: a header, a payload and a signature. The header and payload are Base64URL-encoded JSON, so they can be read by anyone — decoding shows them as formatted JSON and turns timestamp claims (iat, nbf, exp) into dates.

Example

A payload of {"sub":"123","exp":1767225600} shows an expiry date of 1 January 2026 (UTC) and whether that is in the past.

Frequently asked questions

Does this verify the signature?

No. Decoding shows what a token says; only your server, with the key, can verify it wasn’t tampered with.

Does decoding verify the token?

No. Decoding only reads it. Verifying needs the secret or public key, and must happen on your server before trusting any claim.

Is it safe to paste a token here?

Decoding runs in your browser and nothing is sent, but treat live tokens like passwords: prefer expired or test tokens when debugging.

Why can anyone read my JWT?

JWTs are signed, not encrypted. Never put secrets in the payload.