Is my token sent to a server?

No, decoding happens entirely in your browser.

Does this verify the signature?

No, it only decodes the header and payload; verifying the signature requires the secret or public key, which this tool never asks for.

exp is the expiration timestamp, and iat is when the token was issued, both as Unix timestamps.

The token must have exactly three dot-separated, base64url-encoded parts: header, payload, and signature.

Yes, any standard JWT can be decoded regardless of which service issued it.

Decode a JWT's header and payload to inspect its claims, expiration, and issue time — entirely in your browser, without verifying the signature.

JWT token

Issued Jan 18, 2018, 1:30 AM

Header

{
  "alg": "HS256",
  "typ": "JWT"
}

Payload

{
  "sub": "1234567890",
  "name": "John Doe",
  "iat": 1516239022
}

This tool only decodes the token — it does not verify the signature.

Strong password generator with customizable rules

Generate unique UUID v4 identifiers

Format and syntax-highlight JSON

Check JSON syntax and find errors