JWT Decoder
Read a JWT and its timestamps. Your token stays in this tab.
Decoded only. Signature not verified; these claims do not establish trust.
Free to use. Your input stays in this browser.
How to use it
- Paste a three-part JWT and select Decode JWT.
- Read the header and payload JSON. Compare exp, iat and nbf with UTC and your device’s time zone.
- Copy either JSON object, or clear the input and results when finished.
Decoding does not verify a signature or establish trust. Even an unexpired token can be forged, revoked, or intended for a different audience. No verification keys or token creation are provided.
NumericDate claims use Unix seconds, including fractional seconds. Expiration updates every second using your device clock with no clock-skew allowance. Missing or invalid exp cannot establish expiration; iat and nbf are displayed without validating them.
Only readable, three-part JWTs are supported. Encrypted JWE, compressed payloads, and unencoded payloads are not decoded. Input stays in memory and is never placed in a URL, browser storage, logs, or analytics. JSON numbers follow JavaScript precision.