Skip to contentSellstamp
Get started

JWT decoder

Decode a JSON Web Token in your browser to read its header, claims and expiry. It decodes only; the signature is not verified.

Do not paste a live production token here or anywhere else you do not control. This page decodes in your browser and sends nothing, but a token is a password while it is valid.

Stays on your device

Everything runs in your browser. Nothing you type is sent to Sellstamp or anyone else.

Building something to sell?

Sellstamp has a storefront, a checkout into your own payment account, automatic delivery and an API with webhooks. Open a free store

How to use it

  1. Paste a JWT (a “Bearer ” prefix is fine).
  2. Read the header, the payload and the expiry.
  3. Never paste a live production token anywhere you do not control.

Nothing you paste leaves this page

The conversion runs in this browser tab. Nothing is sent to Sellstamp or anyone else, which matters for configuration files, customer exports and tokens.

Decoding is not verifying

A JWT’s header and payload are only Base64url-encoded, so anyone can read them; that is what this tool shows. Trusting the contents requires checking the signature with the key, which belongs on your server and should never be pasted into a web page. Encrypted tokens (JWE, five parts) cannot be read without their key, and the tool says so.

Questions

Is it safe to paste a JWT here?

This page sends nothing anywhere, but a valid token works like a password. Use expired or test tokens when you can.

Why is the signature not checked?

Checking needs the signing key, which should stay on your server.

What do exp, iat and nbf mean?

Expiry, issued-at and not-before times, in seconds since 1970. They are shown as dates in your time zone.

Can JWT contents be secret?

Not in a signed JWT: the payload is readable by anyone who has the token.

Related tools

Popular free tools

All developer toolsEvery free tool