What is a JWT?
A JSON Web Token (JWT) is a compact, URL-safe token format commonly used for authentication and authorization. It has three Base64URL-encoded parts separated by dots: a header (algorithm and token type), a payload (claims, such as the subject and expiration), and a signature.
How to use this tool
Paste a JWT to see its decoded header and payload as readable JSON, along with any iat, nbf, and exp claims converted to human-readable dates. This tool only decodes — it never checks the signature, since that would require the issuer's secret or public key.
Example
Click Load sample to decode a well-known example token. Its header is {"alg":"HS256","typ":"JWT"} — an HMAC-SHA256 signed JWT — and its payload is {"sub":"1234567890","name":"John Doe","iat":1516239022}. The tool shows iat as 2018-01-18 01:30:22 UTC. The sample has no exp claim, so no expiry status is shown.
The three time claims are Unix timestamps in seconds:
iat(issued at) — when the token was created.nbf(not before) — the token must not be accepted before this time.exp(expiration) — the token must not be accepted after this time. When it is present, the tool tells you whether the token is already expired, based on your device's clock.
FAQ
Does this verify the token is valid/trusted?
No. Decoding only reveals the claims a token carries — it does not prove the token wasn't tampered with. Signature verification requires the issuer's secret key and should happen on your server, not in a public browser tool.
Is my token sent anywhere?
No. Decoding happens entirely in your browser. That said, treat real tokens as sensitive — avoid pasting production tokens into any tool you don't fully trust.