Peek inside a JWT.
Paste a JSON Web Token to see its header, payload and expiry. Decoded on your device.
Paste a token
Header
Payload
The signature is not verified — that requires the issuer's key.
How it works
A JWT is three Base64URL parts separated by dots: a header, a payload of claims, and a signature. This tool decodes the first two and turns time claims (exp, iat, nbf) into readable dates.
It does not verify the signature — that needs the issuer's secret or public key. Never trust a token's contents without verifying it on your server.
FAQ
Is it safe to paste a real token?
Decoding happens in your browser and nothing is sent. Even so, tokens are credentials — avoid pasting live production tokens anywhere you don't need to.
Why does it say the token is expired?
The exp claim is earlier than your device's current time. Check your clock if that seems wrong.