JWT Decoder
Paste a JSON Web Token to decode its header and payload and read every claim, including expiry. Runs entirely in your browser.
A JWT decoder splits a JSON Web Token on its dots and base64url-decodes the header and payload so you can read every claim, including the expiry. It does not verify the signature - that needs the signing key, which should never be pasted into a website.
Runs entirely in your browser · no signup · nothing is uploaded · updated 2026-08-29
Decoded in your browser. The token is never sent anywhere.
How to use it
- 1.Paste your JWT into the box.
- 2.The header and payload are base64url-decoded in your browser - nothing is uploaded.
- 3.Check the registered claims, especially exp and iat, against what you expected.
Frequently asked questions
Does my token leave the browser?
No. Decoding happens in JavaScript on this page. There is no network request and no server involved, which is why this tool works offline once loaded.
Does this verify the signature?
No. Verifying requires the signing secret or public key, and you should never paste a secret into a website. Decoding shows you the claims; verification belongs in your own code.
What do exp, iat and nbf mean?
exp is expiry, iat is issued-at, nbf is not-valid-before. All three are NumericDate values - seconds since the Unix epoch, not milliseconds.
Is a JWT encrypted?
No. A standard JWS token is signed, not encrypted, and anyone holding it can read the payload. Never put secrets in a JWT.
Can anyone read my JWT?
Yes. A standard JWT is signed, not encrypted, so anyone who intercepts it reads every claim. Treat it as a bearer credential: transmit over https, store carefully, and put no secrets in the payload.
What is the difference between JWS and JWE?
JWS is signed and readable - it is what almost everyone means by JWT. JWE is encrypted and has five segments instead of three. If your token has four dots, it is JWE and cannot be decoded without the key.
Why does my token say invalid when it looks fine?
Usually padding or whitespace. A JWT copied from a log or header often picks up a trailing newline or a Bearer prefix. Strip both before decoding.
How do I check whether a token has expired?
Read the exp claim, which is seconds since the Unix epoch, and compare it to now. A token expiring in 1,700,000,000 is not the year 1970 - it is a seconds value that needs multiplying by 1000 for JavaScript Date.
The guide behind this tool
2 min readBase64 explained: what it is, and when to use it
How base64 encoding works, why it makes data 33% larger, the difference between base64 and base64url, and the one case where inlining is worth it.
4 min readHow to decode a JWT (and what every claim actually means)
Decode a JSON Web Token by hand or in the browser, understand every registered claim, and know exactly why decoding is not the same as verifying.
3 min readWhy your JSON won't parse, and how to find the character
The five things that make JSON invalid, how to read a parser error into a line and column, and what JSON does not allow that every other format does.
Tools that pair with this one
DeveloperJSON Formatter
Format, validate and minify JSON in your browser. Get the exact line and column of a syntax error instead of a vague parse failure.
DeveloperUUID Generator
Generate cryptographically random UUID v4s, or time-ordered UUID v7s that index far better as database primary keys.
DeveloperRegex Tester
Test a JavaScript regular expression against sample text, see every match with its position and capture groups, and get real errors for invalid patterns.
DeveloperBase64 Encode / Decode
Encode text to base64 or decode it back, with full UTF-8 support and automatic handling of base64url input. Runs entirely in your browser.
Built something?
RankCert is a weekly launch board where products rank on domain control we verify ourselves - not upvotes. Listing is free and the link is dofollow whether or not you display our badge.