UnlimitedConvert
JWT Decoder
Paste a JSON Web Token to see its header, payload and expiry, decoded on your device.
Runs in your browser. Nothing you type or drop here is sent anywhere.
About JWT Decoder
A JWT has three parts separated by dots: header, payload and signature. The first two are URL-safe Base64 JSON, which this tool decodes and formats. Dates like exp, iat and nbf are shown in your local time.
Decoding doesn't check the signature. Never trust a token's contents in your app without verifying it on the server.
Frequently asked questions
Is it safe to paste a real token?
This tool runs entirely in your browser and sends nothing anywhere. Still, treat live tokens like passwords and avoid pasting them into tools you don't trust.
Why isn't the signature verified?
Verification needs the secret or public key, which should never be pasted into a website. Verify tokens in your backend.