JWT Decoder

Decode JSON Web Token headers and payloads and check expiry times.

Runs in your browser · no upload

JWT decoder

Paste a JSON Web Token to read its header and payload. Decoding happens in your browser; the signature is not verified.

Token

Not expiredIssued: 11/14/2023, 10:13:20 PMExpires: 3/17/2030, 5:46:40 PM

Header

{
  "alg": "HS256",
  "typ": "JWT"
}

Payload

{
  "sub": "1234567890",
  "name": "Ada Lovelace",
  "iat": 1700000000,
  "exp": 1900000000
}

Anyone can read a JWT payload. Never trust these claims unless your server verifies the signature with the correct key.

No. Everything runs in your browser, so your token never leaves your device.

No. It only decodes the header and payload. Signature verification needs the secret or public key and should happen on your server.

JWT payloads are Base64URL encoded, not encrypted. Do not put secrets in a JWT payload.