# JWT decoder

> Free JWT decoder: paste a JSON Web Token to read its header and payload, with exp, iat and nbf shown as dates and whether it has expired. Runs in your browser.

Paste a JSON Web Token and this decoder splits it into its header and payload, shows both as formatted JSON, and turns the exp, iat and nbf claims into readable dates with whether the token has expired. It decodes only: the signature is not verified, and the token never leaves your browser.

## FAQ

### Does decoding a JWT verify it?

No. Anyone can read a JWT’s header and payload, because they are only base64url-encoded. Trusting a token requires verifying its signature with the issuer’s key, which this page does not do.

### Is it safe to paste a real token here?

The token is decoded in your browser and is not sent anywhere. Still treat a live token like a password: anyone who has it can use it until it expires.

### What do exp, iat and nbf mean?

They are registered claims from RFC 7519, in seconds since 1970-01-01 UTC: exp is when the token expires, iat when it was issued, and nbf the moment before which it must not be accepted.

### Why does my token have five parts instead of three?

A token with five dot-separated parts is an encrypted JWE, not a signed JWS. Its payload is encrypted, so it cannot be read without the recipient’s key.

Page: https://upapi.io/tools/jwt-decoder · Updated 2026-10-21.