JWT Decoder
Paste a token to read its header and payload. Registered claims are explained, NumericDate timestamps become readable dates with a countdown, and you get a straight answer on whether the token is currently valid.
Output appears here as you type.
Runs entirely in your browser. Nothing you paste here is uploaded or stored.
Questions
Is it safe to paste a real token here?
That is the case this page is built for. Decoding happens in your browser as a pure function, and the page ships a Content-Security-Policy of connect-src ‘none’ - the browser physically refuses to let it open a network connection. Open your network tab, or disconnect entirely: it keeps working.
Does decoding a JWT mean it is verified?
No, and the distinction matters. Anyone can decode a JWT - the payload is base64, not encryption. Decoding tells you what the token claims; only checking the signature against the right key tells you whether to believe it. Use the verifier for that.
Why does my token show as expired when it just worked?
exp is compared against your machine’s clock. If the countdown looks wrong by a consistent amount, the clock is the usual culprit - which is also why servers with drifting clocks reject tokens that ought to be fine.
My token has five segments and will not decode.
Five segments means a JWE - the payload is encrypted, not just signed. There is nothing to read without the decryption key, and no online decoder can change that.