A JSON Web Token is a compact, URL-safe token format used for authentication and data exchange. It has three parts: header.payload.signature, each Base64url-encoded.

Does this verify the JWT signature?

No. Signature verification requires the secret key, which should never be shared. This tool only decodes the header and payload.

Is it safe to paste my JWT here?

All decoding happens in your browser — your token is never sent to any server. However, avoid pasting live production tokens in any online tool as a general best practice.

What does the exp claim mean?

exp (expiration time) is a Unix timestamp indicating when the token expires. This tool displays it as a human-readable date.

JWT Decoder

Developer Tools· 30 tools

Free online JWT decoder. Paste any JSON Web Token to instantly decode and display the header, payload, and signature. Expiration time (exp) and issued-at (iat) claims are displayed as human-readable dates. Your token never leaves your browser.

JWT Token

Frequently Asked Questions

References

RFC 7519 — JSON Web Token (JWT) — IETF
RFC 7515 — JSON Web Signature (JWS) — IETF

Related Tools

Base64 Encoder / Decoder
Encode text to Base64 or decode Base64 back to plain text. Supports full UTF-8 including emoji. Runs in your browser — data never leaves your device.
Hash Generator
Generate SHA-1, SHA-256, and SHA-512 hashes from any text. Results update live as you type — runs via Web Crypto API, data stays in your browser.
JSON Formatter
Format, validate, and minify JSON in your browser. Pretty-print raw JSON with indentation, catch inline syntax errors, or collapse to one line.

Frequently Asked Questions

References and sources

Related Tools