---
title: "JWT Decoder | ToolSugar"
description: "Paste a JSON Web Token to read its header, payload and expiry in plain form. It only decodes and does not verify the signature."
canonical: https://toolsugar.com/tools/jwt-decoder
image: https://toolsugar.com/og.png
---

# JWT Decoder

A JWT decoder reads the header and payload of a JSON Web Token and shows the issued, expiry and not-before times in readable dates. This one runs in your browser and never sends the token anywhere. It only decodes: the signature is not verified, so it cannot prove a token is genuine.

Runs on your device

## How it works

1. Paste the full token (three parts separated by dots) into the JSON Web Token box.
2. Read the Expired or Not expired line and the iat, exp and nbf dates.
3. Review the Header and Payload JSON, and press Copy on either one.
4. Remember the signature is shown but not verified.

## Key facts

- **Decodes**: Header and payload, as Base64URL-encoded JSON
- **Time claims**: iat, exp and nbf shown in UTC and in your local time
- **Signature**: Shown as text but NOT verified
- **Privacy**: The token stays in your browser tab and is never sent anywhere

## Common uses

- Check why an API call returned 401 by seeing whether the token has expired.
- Inspect the claims and algorithm of a token while debugging a login flow.
- Confirm which audience or scopes a token was issued for.

## Questions

### Does this verify a JWT signature?

No. It only decodes the header and payload. Verifying a signature needs the secret or public key, and this tool never asks for one, so treat everything it shows as unverified.

### Is it safe to paste a real token here?

The decoding happens in your browser and the token is not sent to any server. Even so, treat live tokens as secrets and prefer expired or test tokens when you can.

### Why does it say my token is expired?

The tool compares the exp claim, in seconds since 1970, with your device clock. If exp is in the past, the token is marked Expired. A wrong device clock can make a valid token look expired.

[Read the JWT Decoder guide](https://toolsugar.com/blog/how-to-decode-a-jwt)

## Related tools

- [Base64 Encoder and Decoder](https://toolsugar.com/tools/base64-encoder)
- [JSON Formatter](https://toolsugar.com/tools/json-formatter)
- [UUID Generator](https://toolsugar.com/tools/uuid-generator)