A JSON Web Token (JWT) is a compact, signed token made of three Base64url-encoded parts separated by dots: a header describing the signing algorithm, a payload of claims, and a signature.

Does this tool verify the signature?

No. This decodes the header and payload so you can read their contents, but it does not verify the signature, since that requires the secret key or public key the token was signed with. Never trust the contents of a JWT without verifying its signature server-side.

What do exp, iat, and nbf mean?

These are standard time-based claims: iat is when the token was issued, nbf is the earliest time it becomes valid, and exp is when it expires. This tool shows a readable date next to each one automatically.

Why does it say my token is invalid?

A JWT must have exactly three dot-separated parts, and the first two must decode to valid JSON. If either check fails, the pasted text is not a well-formed JWT.

Is my token sent anywhere?

No. Decoding happens entirely in your browser and the token is never sent to a server, but treat any real token as sensitive and avoid pasting production tokens into third-party tools when you can avoid it.

DAILYTOOLER

JWT decoder

Paste a JSON Web Token to see its header and payload decoded, with claim timestamps and an expiry check.

JWT

What is a JWT decoder?

Paste a JSON Web Token to see its header and payload decoded into readable JSON, with an expiry check for tokens that include an exp claim. This only decodes the token, it does not verify its signature.

JWT decoder

What is a JWT decoder?

Frequently asked questions