Security
Processed locally in your browser — not uploaded
JWT Decoder
Paste a JWT to see its decoded header and payload as formatted JSON, plus issued-at, not-before and expiration dates. This does not verify the signature — that requires the signing key. Runs entirely in your browser; the token is never sent anywhere.
Privacy Guaranteed: Token is decoded locally in your browser. Signature is not verified.
Header (36 chars) Payload (74 chars) Signature (43 chars)
Token Status:⚪ No Expiration Claim
Header (Algorithm & Type)
{
"alg": "HS256",
"typ": "JWT"
}Payload (Claims Data)
{
"sub": "1234567890",
"name": "John Doe",
"iat": 1516239022
}Standard Time Claims Summary
- Issued At (iat)
- 2018-01-18T01:30:22.000Z
- Not Before (nbf)
- Not specified
- Expiration Time (exp)
- No expiration
01
How to use
- Paste a JWT into the input field.
- The header and payload are decoded and shown as formatted JSON.
- If the payload has an exp claim, its expiration status and date are shown.
02
Understanding the output
A JWT has three dot-separated, base64url-encoded parts: header, payload and signature. This tool decodes the header and payload into readable JSON. It does not verify the signature — that requires the signing key, which never leaves the issuing server.
03
Common issues & tips
- •"Not a JWT" error: the token needs exactly three dot-separated parts.
- •Decode error: the header or payload segment isn't valid base64url-encoded JSON — the token may be truncated or corrupted.
Frequently asked questions
- Does this verify the JWT's signature?
- No. Verifying a signature requires the secret or public key used to sign the token, which this tool never has. This only decodes the header and payload, which are base64url-encoded but not encrypted.
- Is my token sent to a server?
- No. Decoding happens entirely in your browser.
- Why does it say the token has no expiration?
- The exp claim is optional. If it's missing from the payload, the token has no built-in expiration.