⚡All Tools 💻Dev Tools 📝Text & Writing 🎨Design & Color 🖼️Image & Media 🔢Math & Calculators 🔒Security & Crypt 📄PDF Tools 📐Unit Converters

JWT Decoder & Parser

Decode and inspect JWT JSON structures (Header/Payload/Signature) and view expiration metadata.

Enter JWT Token

Token Status & Metadata

Status -

Expires At: -

Issued At: -

Not Before: -

Header

{}

Payload

{}

Signature

How to use this tool

1 Open JWT Decoder & Parser, then enter, paste, or choose the content you want to process.
2 Adjust the available options and output format for your task.
3 Review the instant result, then copy or download the available output.

Common use cases

Decode and inspect JWT JSON structures (Header/Payload/Signature) and view expiration metadata. Use it for everyday work, development, learning, or quick verification.

Privacy and data handling

This tool runs in your browser. Before working with sensitive data, make sure you trust your browser and device environment.

JWT structure, common claims, and why decoding is not verifying

A JWT (JSON Web Token) is the most common credential format for API authentication. It consists of three strings separated by dots. The header states the signing algorithm (such as HS256 or RS256) and type. The payload holds claims such as the user ID, roles and expiry time. The signature is computed by the server over the first two parts with a key, proving they have not been tampered with. The first two parts are only Base64URL-encoded, not encrypted.

Paste a token into the tool and it instantly decodes the header and payload into formatted JSON, while the signature is shown as-is. Common time claims are converted into readable local time: exp is the expiry time, iat the issued-at time and nbf the not-before time (the token should not be accepted earlier). The tool also uses exp to tell you whether the token has expired. It is handy for debugging login flows, checking role claims or working out why users keep getting logged out.

An important point: decoding is not verification. The tool does not check the signature with a key, and anyone can forge a payload that looks legitimate. Your back end must verify the signature, algorithm and exp with a trusted library and reject tokens whose alg is none. And because anyone can read the payload, never put passwords, national ID numbers or other sensitive data in a JWT.

A token is a login credential, so pasting it into an unknown website hands over access to the account. This tool decodes entirely in your browser and never sends or logs the token. Even so, prefer expired tokens or test-environment samples when working with production systems.

Frequently asked questions

Is a JWT encrypted?

A typical JWT (JWS) is signed, not encrypted. The header and payload are Base64URL-encoded, so anyone can decode and read them.

Does this tool verify the signature?

No. It only decodes and displays the contents. Signature verification needs the key and should be done on the back end with a trusted library.

What do exp, iat and nbf mean?

exp is the expiry time, iat the issued-at time and nbf the not-before time. All three are Unix seconds, shown here as local time.

Is it safe to paste my token?

Decoding happens in your browser and the token is not uploaded. Still, a token is a login credential, so use test or expired tokens for production systems.

Browse this category: Dev Tools

💻

Dev Tools