Quick Summary
JWT Decoder is a 100% client-side tool that decodes a JSON Web Token into its header, payload, and claims , including issued-at and expiry status, directly inside your browser memory. Signatures are never verified or uploaded.
JWT Decoder — Inspect JSON Web Tokens
Decode the header and payload of any JWT and check expiry, all without sending your token anywhere.
Header & Payload
Instantly view the decoded JOSE header and claims payload as pretty-printed JSON.
Expiry checks
Human-readable iat, nbf, and exp timestamps with an at-a-glance expired/valid indicator.
Private by Design
Tokens are decoded locally. Nothing is transmitted, logged, or stored on any server.
Frequently asked questions
Is it safe to paste my JWT here?
Yes. Decoding runs entirely in your browser memory and your token is never uploaded to any backend server.
Does this verify the token signature?
No. This tool only decodes and displays the token contents. It does not cryptographically verify the signature, so never trust decoded claims for authorization decisions.
What does "EXPIRED" mean?
If the payload contains an
exp claim in the past relative to your device clock, the tool flags the token as expired.