// free · runs in your browser · nothing uploaded
JWT Decoder & Expiry Checker
Free JWT decoder: see the header and payload of a JSON Web Token, readable exp and iat dates, whether it has expired, and check HS256/HS384/HS512 signatures with your secret. Nothing leaves your browser.
Header
{
"alg": "HS256",
"typ": "JWT"
}Payload
{
"sub": "1234567890",
"name": "Test User",
"iat": 1760000000,
"exp": 2000000000
}Dates in this token
| exp | 5/18/2033, 8:33:20 AM | 2000000000 |
| iat | 10/9/2025, 1:53:20 PM | 1760000000 |
Check the signature (HS256 / HS384 / HS512)
Enter the secret to check the signature.
Decoding a JWT does not prove it is genuine: anyone can read a token's contents. Never paste live production secrets into any website; this tool runs entirely in your browser and sends nothing anywhere.
📚 Official sources: JWT standard (RFC 7519)
We build every tool from the official rules and re-check them when they change. Always confirm with the official source before you rely on a result.
🛠️ Spotted a mistake or an out-of-date rule? Tell us
Questions people ask
What is a JWT?+
A JSON Web Token: three Base64URL parts (header, payload, signature) joined by dots. It is used to prove who you are to an API.
Does decoding prove a token is genuine?+
No. Anyone can read a JWT. Only checking the signature with the right key proves it was issued by the server.
What do exp, iat and nbf mean?+
exp is when the token expires, iat when it was issued, and nbf the time before which it must not be accepted. They are Unix timestamps in seconds.