JWT Decoder

Decode JWT headers and payloads locally. Inspect expiration and other timestamp claims in UTC.

The decoder does not send or save your token. Do not share tokens or include them in URLs.

Signature not verified. Decoding does not prove authenticity or grant authorization.

How to inspect a JWT

Paste a three-part JWT and decode its Base64url header and payload. exp is expiration, nbf is not-before and iat is issued-at; these timestamps are seconds since the Unix epoch. Times are evaluated using your device clock, without clock-skew allowance. Missing exp does not mean a token is valid. JWE decryption and cryptographic signature validation are not supported.