JWT Decode
Decode JWT tokens instantly and view header, payload, and signature
JWT Token
Decoded tokens will appear here. Your last 3 tokens are kept.
Decode JWT tokens instantly and view header, payload, and signature
Decoded tokens will appear here. Your last 3 tokens are kept.
A JWT is three Base64URL parts separated by dots: a header (signing algorithm), a payload (claims) and a signature. The decoder shows header and payload as JSON, lists iss, sub and aud, and turns exp, nbf and iat into dates with a valid or expired status. It does not verify the signature. Your last three tokens stay on the page for diffing.
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.<signature>
header payload signature"exp": 1735689600 → 1 Jan 2025, 00:00:00 UTC (expired)No. It decodes the token so you can read it. Verifying the signature requires the secret or public key and should be done by your server.
The token is decoded in your browser and never sent to our server. Still, treat valid tokens like passwords and avoid sharing them.
Usually not. A standard signed JWT (JWS) is only encoded, so anyone with the token can read its payload. Never put secrets in it.
exp is the expiry time, iat is when the token was issued, and nbf is the time before which it must not be accepted. All are Unix timestamps in seconds.