Relic
Get Relic free

JWT Decoder

Paste a JSON Web Token to read its header and payload, with the expiry spelled out. Nothing leaves your browser.

Runs entirely in your browser. Nothing you type is uploaded.
Token
Issued at (iat)
6/15/2025, 3:06:40 PM
Expires (exp)
3/17/2030, 5:46:40 PM
Header
{
  "alg": "HS256",
  "typ": "JWT"
}
Payload
{
  "sub": "1234567890",
  "name": "Jane Doe",
  "iat": 1750000000,
  "exp": 1900000000
}
Decoding is not verification. This reads the token; it does not check the signature.

Read any JWT in seconds

A JSON Web Token is just three base64url chunks joined by dots: a header, a payload of claims, and a signature. The first two are not encrypted, only encoded, so this tool splits the token, decodes the header and payload, and pretty-prints both. If it spots an exp or iat claim it shows them as real dates and tells you whether the token has expired. It never checks the signature, so treat it as a viewer, not a validator.

For the tokens you paste and lose all day

Debugging auth means copying tokens constantly, and your clipboard only ever holds the last one. Relic is an encrypted, permanent memory for everything you copy, so every token, secret, and payload you grab stays searchable on every device, end-to-end encrypted so only you can read it. Decode here for free; stop losing the thing you just copied.

Learn: want the header, claims, and signature explained properly? Read What is a JWT token?

Frequently asked questions

How do I decode a JWT?

Paste the token and the tool splits it on the dots, then base64url-decodes the header and payload and pretty-prints both. If the token has an exp or iat claim, it also shows those as real dates and tells you whether the token has expired.

Does this tool verify the JWT signature?

No. It only decodes the token so you can read it; it does not check the signature, which would require the signing key. Treat it as a viewer, not a validator. A token that decodes cleanly here can still be forged or tampered with, so never trust a JWT in production without verifying its signature server-side.

Is a JWT encrypted? Can I put secrets in it?

No, a standard JWT is only base64url-encoded, not encrypted. Anyone who has the token can read the payload, exactly like this tool does. Never put passwords, API keys, or other secrets in a JWT payload, and treat the token itself as sensitive.

What do the three parts of a JWT mean?

A JWT is header.payload.signature. The header says which algorithm signed it, the payload holds the claims (like sub, iat, and exp), and the signature lets a server confirm the token was not altered. This tool shows the first two; the signature is only meaningful when verified with the key.

Is my token sent anywhere when I decode it?

No. Decoding happens entirely in your browser, so the token you paste is never uploaded. That matters, because a JWT is a live credential, and pasting one into a server-side decoder would be leaking it.

More free tools
JSON Formatter
json formatter
Base64 Encode / Decode
base64 decode
Diff Checker
diff checker
URL Encode / Decode
url decoder
UUID Generator
uuid generator
Epoch Converter
epoch converter
All tools