🔑 JWT Decoder

Decode and inspect JWT tokens instantly — view header, payload, and signature. Verify signatures with your secret. Free online JWT decoder — nothing sent to any server.

JWT Token

How to Use

Paste your JWT

Copy your JWT token (starting with eyJ) and paste it into the input field.

Click Decode

Press Decode to instantly split and decode all three parts: header, payload, and signature.

Inspect the token

Read the decoded JSON, check expiration dates, algorithm, and any custom claims in the payload.

Frequently Asked Questions

What is a JWT? +

A JSON Web Token (JWT) is a compact, URL-safe token used for authentication and information exchange. It consists of three Base64URL-encoded parts separated by dots: Header.Payload.Signature.

Is it safe to paste my JWT here? +

Yes. This tool runs 100% in your browser — your token is never sent to any server. However, never share JWTs containing sensitive data in public forums or untrusted tools.

Can this tool verify the JWT signature? +

No. Signature verification requires the secret key or public key used to sign the token, which only your server knows. This tool decodes and displays the token contents only.

What does "exp" mean in the payload? +

"exp" is the expiration time as a Unix timestamp (seconds since Jan 1, 1970). This tool automatically converts it to a human-readable date and shows whether the token has expired.

What is the difference between "iat" and "nbf"? +

"iat" (issued at) is when the token was created. "nbf" (not before) is the earliest time the token is valid. Both are Unix timestamps.

Guía: Decodificador de JWT

¿Qué es?

Un JWT (JSON Web Token) es un estándar para transmitir información verificable. Consta de tres partes Base64URL separadas por puntos: header.payload.signature. El payload contiene claims como ID de usuario, roles y tiempo de expiración.

El payload es visible para cualquiera — nunca incluyas datos sensibles sin cifrado adicional.

Cómo usar

Pega el JWT completo en el campo de entrada.
Header y payload se decodifican como JSON formateado.
Verifica la expiración en el campo exp (timestamp Unix).
Inspecciona los claims para depurar autenticación.

Consejos

Esta herramienta solo decodifica — la verificación de firma requiere la clave secreta en el servidor.
Nunca pegues JWTs de producción en herramientas online si contienen datos sensibles.
Revisa siempre exp e iat al depurar errores de autenticación.