JWT Decoder

Decodes the header and payload of a JSON Web Token. Runs entirely in your browser — nothing is sent anywhere. This does not verify the signature; decoding a JWT never requires the secret/private key, only verifying one does, so treat any claims shown here as unverified until something has actually checked the signature.

About exp, iat, and nbf

These three standard claims are Unix timestamps (seconds since 1970-01-01 UTC): iat (issued at), exp (expires at), and nbf (not valid before). This tool converts them to a readable UTC date automatically since a raw 10-digit number is hard to sanity-check at a glance.