How it works
A JWT has three parts separated by dots: a header, a payload and a signature. The header and payload are JSON written in Base64URL, so anyone can read them.
This tool decodes the first two parts and shows them as formatted JSON. Common date claims, such as exp (expires), iat (issued at) and nbf (not before), are shown as readable UTC dates.
It does not check the signature. Decoding is not the same as trusting: only your server, with the right key, can verify that a token is genuine.
Good to know
A JWT is encoded, not encrypted. Do not put secrets in the payload.
Avoid pasting live production tokens into any website. This tool never sends the token, but expired or test tokens are the safer habit.
Frequently asked questions
Does this verify the token?
No. It only decodes it. Verification needs the secret or public key and should be done on your server.
Is my token sent to a server?
No. It is decoded in your browser. You can check by turning off your connection and using the tool.
What do exp, iat and nbf mean?
exp is when the token expires, iat is when it was issued and nbf is the time before which it must not be accepted. All are Unix timestamps in seconds.