B64
No signupBase64 Encoder
Encode text to Base64, with correct Unicode handling.
Open toolJWT
JWT Decoder
Decode JWT header and payload, with expiry and claims shown clearly.
jwt-decoder.tool
Nothing you paste here is ever sent to a server - decoding happens locally in your browser.
What is a jwt decoder?
A JWT (JSON Web Token) is a compact token made of three Base64URL-encoded parts - header, payload, and signature - separated by dots. This tool decodes the header and payload back into readable JSON, and highlights standard time-based claims like exp (expiry) and iat (issued at) with human-readable dates and whether the token is expired.
How to use this tool
- 1Paste a JWT - decoding happens live as you type or paste.
- 2The header and payload are shown as formatted JSON, with the raw signature alongside.
- 3Standard time claims (exp, iat, nbf) are translated into readable dates with relative time, and an expired badge appears if the token is past its exp claim.
- 4Copy any section individually.
Common use cases
Debugging why an API call is being rejected as unauthorized
Checking what claims are actually inside a token issued by an auth provider
Confirming whether a token has expired without decoding it by hand
Inspecting a token during integration work with a new authentication system
Good to know
Frequently asked questions
Does this verify the token's signature?
No - verifying a signature requires the secret or public key used to sign it, which this tool never asks for or transmits. It only decodes the parts that are already readable without any key: the header and payload.
Is a JWT's payload encrypted?
No - the header and payload are only Base64URL-encoded, not encrypted. Anyone with the token can read them, which is why sensitive data generally shouldn't be placed in a JWT payload.
What do exp, iat, and nbf mean?
exp is the expiration time, iat is when the token was issued, and nbf ("not before") is the earliest time the token becomes valid - all standard JWT claims expressed as Unix timestamps.
Is my token sent anywhere?
No - decoding happens entirely in your browser. Nothing about the token is transmitted or logged.
quick_facts.json
{
"runs_in_browser": true,
"data_sent_to_server": false,
"signup_required": false,
"price": "free",
"category": "Encoding"
}