Header
Payload
Timestamp claims
What is a JWT?
A JSON Web Token (JWT) is a compact, URL-safe token used for authentication and passing claims between services. It has three Base64URL-encoded parts separated by dots: a header, a payload, and a signature. This decoder reveals the header and payload in readable JSON and converts the time claims (exp, iat, nbf) into real dates — all in your browser.
Frequently Asked Questions
Does this verify the token’s signature?
No. It decodes the token so you can read it — it does not verify the signature, because that requires the server’s secret or public key. A decoded token is not proof it’s authentic or untampered.
Is it safe to paste a token here?
Decoding happens entirely in your browser — nothing is uploaded. Still, a JWT is a live credential: anyone holding it can act as you until it expires. Don’t share tokens, and avoid pasting production tokens into any online tool.
Why is the payload readable — isn’t that insecure?
JWT payloads are only encoded, not encrypted, so never put secrets in them. Security comes from the signature (integrity) and HTTPS (transport), not from hiding the payload.
What do exp, iat and nbf mean?
iat = issued at, nbf = not valid before, exp = expires. They’re stored as Unix timestamps; this tool shows them as dates and tells you whether the token is currently valid.
