What is this tool?
A JWT is a compact token format made of Base64URL-encoded sections. Developers often decode tokens to inspect claims such as issuer, subject, audience, roles, issued-at time, and expiration time.
How to use it
Paste a three-part JWT to view its decoded JSON header and payload, then check claims such as exp, iat, iss, and aud.
Related practical guides
JWT decoding guide →Decode JWT locally →JWT exp timestamp converter →JWE vs JWT →Common uses
- Inspect authentication claims while debugging an API.
- Check issuer, audience, roles, and subject values.
- Convert
iat,nbf, andexpclaims into readable dates.
Common mistakes
- A decoded JWT is not necessarily valid; its signature must still be verified.
- Do not share active production tokens because they may grant access.
- JWT timestamps normally use seconds, while some systems use milliseconds elsewhere.
Practical example: Checking JWT expiration
Paste a token and compare its exp date with the current time. An expired token should be refreshed or rejected by the application.
Privacy
This tool is designed to process your input locally in the browser. Avoid entering passwords, private keys, or other sensitive production data into any online tool.
Frequently asked questions
Does this verify the JWT signature?
No. Decoding a token does not verify its signature or prove that it is trustworthy.
Should I paste production tokens?
Avoid sharing sensitive production tokens with any online tool, even when processing is local.
What does exp mean in a JWT?
The exp claim is the expiration time. It is normally a Unix timestamp in seconds.