Developer Utilities
JWT Decoder
Paste a JSON Web Token to read its header and payload, convert the expiry and issued-at claims to dates, and see whether it has expired. Decoding happens locally — nothing is uploaded, and the signature is not verified.
Nothing leaves your device
This decoder Base64URL-decodes the token's parts locally in your browser. Nothing you paste is sent to a server, logged or stored. Even so, a live token is a credential — handle it with the same care you would a password.
What a JWT is
A JSON Web Token is the compact header.payload.signature string that many applications use for login sessions and API authorisation. Each of the three parts is Base64URL-encoded. The header names the signing algorithm, the payload carries the claims — who the user is, when the token was issued, when it expires — and the signature lets the server confirm the token has not been tampered with.
What decoding shows, and what it doesn't
Decoding reveals the header and payload in full. What it does not do is prove the token is genuine: verifying the signature requires the secret key (for HMAC) or the issuer's public key (for RSA and ECDSA), which a decoder does not have. So read a decoded token as information, not proof.
The payload is not encrypted.
Because the payload is merely encoded, anyone who holds the token can read every claim inside it. Never store secrets, passwords or sensitive personal data in a JWT payload — treat it as fully public.
Reading the claims
Several claim names are standardised. The time-based ones — iat (issued at), nbf (not before) and exp (expires) — are Unix timestamps, which this tool converts to readable dates, along with a badge showing whether the token has already expired. Others you will often see are iss (issuer), sub (subject) and aud (audience).
Frequently asked questions
Does this verify the token's signature?
No. This tool decodes the header and payload so you can read them, but it does not check the signature, which would require the secret or public key. Treat a decoded token as unverified: the contents are readable, not proven authentic.
Is my token sent anywhere?
No. Decoding happens entirely in your browser by Base64URL-decoding the token's parts. Nothing is transmitted, logged or stored. That said, a real token is a credential, so take the same care with it you would a password.
Can anyone read the contents of a JWT?
Yes. The header and payload are only Base64URL-encoded, not encrypted, so anyone holding the token can read them. For that reason you should never place secrets or sensitive personal data in a JWT payload.
What do the exp, iat and nbf fields mean?
They are standard time claims, all expressed as Unix timestamps: iat is when the token was issued, nbf the earliest time it is valid, and exp when it expires. This tool converts them to readable dates and flags whether the token has expired.
Last reviewed: · Reviewed by the ShowMyIP team