JWT Decoder
Read a token's Base64URL-encoded header, claims and common timestamps. This decoder does not validate authenticity.
Important: Decoding a JWT does not verify its signature.
Header
Payload
What is this tool?
A JSON Web Token usually contains a header, payload and signature separated by dots. This tool decodes the first two sections into readable JSON and displays exp and iat dates when present.
How to use
- Paste a three-part JWT.
- Select Decode token.
- Inspect the formatted header and payload.
- Treat all displayed claims as unverified data.
Example
A payload containing {"sub":"123","exp":1893456000} shows both the raw expiration value and its local date.
FAQ
Does this validate the signature?
No. Decoding only reveals content; it does not prove who created the token or whether it was altered.
Why can anyone read a JWT?
Standard JWT content is encoded, not encrypted. Do not place secrets in an ordinary JWT payload.
Which timezone is shown?
Human-readable time claims use your device's local timezone; the original numeric claim is also shown.