JWT Decoder
Decode a JWT and check its expiry. Decodes only — it never verifies the signature.
Runs locally in your browser. Your input is never sent anywhere.
Decodes only. The signature is shown but never verified — that needs the signing key. A token that decodes cleanly can still be forged or tampered with.
Validity
Signature (not verified)
What is a JWT?
A JSON Web Token has three base64url-encoded segments separated by dots:
header.payload.signature. The first two are just encoded JSON — not
encryption. Anyone holding the token can read them, which is why a JWT should never
carry secrets.
Why the signature is not checked
Verifying a signature requires the signing key. Sending your key to a website, or sending the token to a server that holds one, is exactly what you should not do. This tool therefore decodes and nothing more. Verify tokens in your own backend, with your own key.
Expiry claims
exp is when the token stops being valid, iat when it was
issued and nbf the earliest it may be used. All three are
NumericDate values — seconds since the Unix epoch, not milliseconds, which
is a common source of tokens that appear to expire in 1970.