Skip to content
HQ8T

JWT Decoder

Decode JSON Web Tokens and check expiry times.

How to use

  1. 1Paste your JWT (the long text with two dots) into the box.
  2. 2See the decoded header and payload as formatted JSON.
  3. 3Check the issued-at, not-before and expiry times shown as readable dates.
  4. 4Copy the header or payload if you need them.

Frequently asked questions

Is it safe to paste my token here?

Decoding happens entirely in your browser and nothing is sent. Still, treat live tokens like passwords and avoid sharing them.

Does this verify the signature?

No. It only decodes the token so you can read it. Verifying the signature needs the secret or public key and should be done by your server.

What do exp, iat and nbf mean?

exp is when the token expires, iat is when it was issued and nbf is the time before which it isn't valid. They're Unix timestamps, which we convert to dates.

Why can anyone read a JWT?

A JWT's payload is only Base64URL-encoded, not encrypted. Never put secrets like passwords inside a JWT payload.

Can I paste “Bearer …”?

Yes. The “Bearer ” prefix is removed automatically.

You may also need