Paste a JWT
Header
Payload
Paste any JSON Web Token and its header and payload are decoded and pretty-printed instantly, with the token's three parts color-coded the way jwt.io does. Expiry (exp), issued-at (iat) and not-before (nbf) claims are converted to readable dates with a relative-time flag, so you can see at a glance whether a token is expired. This tool only decodes — it does not verify the signature, and never sends the token anywhere.
No — it only decodes the header and payload, which is all base64url-encoded and readable by anyone without a key. Verifying a signature needs the secret or public key it was signed with, which this tool never asks for.
No. Decoding happens entirely in your browser with nothing more than atob() and JSON.parse() — no network request is ever made.
From the standard exp claim (a Unix timestamp in seconds). If it's in the past, the token is flagged expired; if the nbf claim is in the future, it's flagged not valid yet. Tokens without an exp claim are flagged as having no expiry.
A JWT is three base64url segments separated by dots. If yours doesn't split into exactly three parts, or a part isn't valid base64url JSON, an error explains exactly what failed.