# JWT Decoder > A JWT decoder splits a JSON Web Token on its dots and base64url-decodes the header and payload so you can read every claim, including the expiry. It does not verify the signature - that needs the signing key, which should never be pasted into a website. Source: https://rankcert.com/tools/jwt-decoder Free, no signup. Updated: 2026-08-29 ## How to use it 1. Paste your JWT into the box. 2. The header and payload are base64url-decoded in your browser - nothing is uploaded. 3. Check the registered claims, especially exp and iat, against what you expected. ## Questions ### Does my token leave the browser? No. Decoding happens in JavaScript on this page. There is no network request and no server involved, which is why this tool works offline once loaded. ### Does this verify the signature? No. Verifying requires the signing secret or public key, and you should never paste a secret into a website. Decoding shows you the claims; verification belongs in your own code. ### What do exp, iat and nbf mean? exp is expiry, iat is issued-at, nbf is not-valid-before. All three are NumericDate values - seconds since the Unix epoch, not milliseconds. ### Is a JWT encrypted? No. A standard JWS token is signed, not encrypted, and anyone holding it can read the payload. Never put secrets in a JWT. ### Can anyone read my JWT? Yes. A standard JWT is signed, not encrypted, so anyone who intercepts it reads every claim. Treat it as a bearer credential: transmit over https, store carefully, and put no secrets in the payload. ### What is the difference between JWS and JWE? JWS is signed and readable - it is what almost everyone means by JWT. JWE is encrypted and has five segments instead of three. If your token has four dots, it is JWE and cannot be decoded without the key. ### Why does my token say invalid when it looks fine? Usually padding or whitespace. A JWT copied from a log or header often picks up a trailing newline or a Bearer prefix. Strip both before decoding. ### How do I check whether a token has expired? Read the exp claim, which is seconds since the Unix epoch, and compare it to now. A token expiring in 1,700,000,000 is not the year 1970 - it is a seconds value that needs multiplying by 1000 for JavaScript Date. ## Related tools - [JSON Formatter](https://rankcert.com/tools/json-formatter): Format, validate and minify JSON in your browser. Get the exact line and column of a syntax error instead of a vague parse failure. - [UUID Generator](https://rankcert.com/tools/uuid-generator): Generate cryptographically random UUID v4s, or time-ordered UUID v7s that index far better as database primary keys. - [Regex Tester](https://rankcert.com/tools/regex-tester): Test a JavaScript regular expression against sample text, see every match with its position and capture groups, and get real errors for invalid patterns. - [Base64 Encode / Decode](https://rankcert.com/tools/base64-encode-decode): Encode text to base64 or decode it back, with full UTF-8 support and automatic handling of base64url input. Runs entirely in your browser. - [Wildcard Mask Calculator](https://rankcert.com/tools/wildcard-mask-calculator): Convert a CIDR prefix or subnet into the wildcard mask Cisco ACLs and OSPF network statements expect, with the subnet mask and address range alongside it. - [Diff Checker](https://rankcert.com/tools/diff-checker): Paste two versions of a text and see every added and removed line highlighted, computed in your browser with no upload.