JWT Decoder

How to decode a JWT

1. Paste the token. A leading "Bearer " is removed for you.
2. The header and payload appear as formatted JSON, with exp, iat and nbf shown as dates.
3. Check whether the token has expired in the status line.

Frequently asked questions

Is it safe to paste a token here?

The token is decoded in your browser and never sent anywhere. Still, treat live tokens like passwords and avoid pasting production tokens into sites you do not trust.

Does it verify the signature?

No. Verifying needs the secret or public key, which should stay on your server. Decoding only reads the contents, which anyone holding the token can do.

Is a JWT encrypted?

Usually not. Standard JWTs are only encoded and signed, so never put secrets in the payload.