Free tools / JWT Parser
Decode a JWT
Paste a JSON Web Token to inspect its header and payload and see when it was issued and expires. It decodes in your browser only - the token is never sent anywhere. This does not verify the signature.
JWT
Header
Payload
How it works
- 1Paste a JWT - the three dot-separated Base64URL parts (header.payload.signature).
- 2We Base64URL-decode the header and payload and pretty-print the JSON.
- 3Standard time claims (iat, exp, nbf) are shown as human-readable dates, with an expiry status.
Frequently asked
Does this verify the signature?
No - it only decodes. A JWT payload is Base64, not encrypted, so anyone can read it; verifying the signature needs the secret or public key, which this tool never asks for and never has.
Is my token sent to a server?
No. Decoding happens entirely in your browser, so it's safe to inspect a real token - though you should still treat live tokens as secrets.
Why is the payload readable without a key?
That's how JWTs work: the header and payload are only Base64URL-encoded (not encrypted). The signature protects against tampering, not against reading - never put secrets in a JWT payload.