JWT Decoder
Decode JWT header and payload, validate time-based claims (exp, nbf), and inspect standard claims — all locally in your browser. No data is sent to any server.
Privacy: All decoding happens locally in your browser. No data is sent to any server.
Paste a JWT to decode
0 chars · 0 bytes
Issuer (iss)
—
Audience (aud)
—
Expiration (exp)
—
exp (local time)
—
Issued at (iat)
—
Not before (nbf)
—
Do not share sensitive tokens publicly. Anyone can decode JWT contents; treat them like secrets.
Header
Header JSON will appear here
Payload
Payload JSON will appear here
SignatureWhat is this?
Signature will appear here
The signature proves the token wasn’t modified. You can’t “decode” it — you can only verify it using the right key.
HS256 verification (optional)Provide a secret to verify HS256.
All decoding happens locally in your browser. No data is sent to any server.
How to Use This Tool
- Paste your JWT into the input box.
- Review decoded Header and Payload side by side.
- Check validity status (expired / not active yet / valid) based on
expandnbf. - Optionally verify HS256 signatures by providing the shared secret.
- Copy or download the decoded JSON.