JWT Decoder: Read Header, Payload and Expiry
Read a JWT's header, claims and expiry without sending it anywhere.
The signature is not verified. Decoding only reveals what the token claims; anyone can create a token with any claims, so always verify it on your server.
Use via API
Decode a JWT's header and payload. Does not verify the signature. Send JSON, get JSON back.
POST https://pithlab.com/api/v1/tools/jwt-decoder
curl https://pithlab.com/api/v1/tools/jwt-decoder \
-H "Authorization: Bearer $PITHLAB_KEY" \
-H "Content-Type: application/json" \
-d '{"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkFkYSIsImlhdCI6MTcwMDAwMDAwMH0.signature"}'About the JWT Decoder
Decode a JSON Web Token to read its header and payload, with exp, iat and nbf shown as dates and an expiry check. Runs in your browser; signatures are not verified.
How to use the JWT Decoder
- Paste a JWT into the input box. A leading “Bearer ” prefix is ignored.
- Read the decoded header and payload, pretty-printed as JSON.
- Check the time claims table: exp, iat and nbf are shown as UTC and local dates, with whether the token is currently expired.
- Copy the header or payload JSON if you need it elsewhere.
Examples
Input
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkphbmUgRG9lIiwiYWRtaW4iOnRydWUsImlhdCI6MTc2MDAwMDAwMCwiZXhwIjoxNzYwMDAzNjAwfQ.8HShEEKUlGIXMO6i6Ei8FcEt3IqHeR9S0TOr8sf-Fc4
Output
{
"sub": "1234567890",
"name": "Jane Doe",
"admin": true,
"iat": 1760000000,
"exp": 1760003600
}Frequently asked questions
Does this tool verify the signature?
No. It only decodes the header and payload, which are base64url-encoded rather than encrypted. Anyone can create a token with any claims, so never trust a decoded payload until your server has verified the signature with the correct key.
Is it safe to paste a real token here?
Decoding happens entirely in your browser and nothing is uploaded. Even so, a live token is a credential, so avoid pasting production tokens into any website you do not control and prefer expired or test tokens.
What do exp, iat and nbf mean?
They are registered claims from RFC 7519, given in seconds since 1 January 1970 UTC. exp is when the token expires, iat is when it was issued, and nbf is the time before which it must not be accepted.
Why can't it decode my token?
A signed JWT has exactly three dot-separated parts. Encrypted tokens (JWE) have five parts and need a key to read, and opaque access tokens are not JWTs at all, so they cannot be decoded.