FreePanda

JWT Decoder

Developer Tools

Decode JWT header and payload and inspect expiry claims.

Runs entirely in your browser — nothing is uploaded

What people do next

Base64 to Image ConverterDecode Base64 or a data URI back into a viewable, downloadable image.JWT GeneratorSign HS256, HS384 or HS512 JSON Web Tokens from a payload and secret.JWT InspectorDecode a token and audit its claims, expiry and signature settings.

Features

  • Splits header, payload and signature into readable panels.
  • Renders exp, iat and nbf as human-readable dates with a live countdown.
  • Flags expired tokens immediately.
  • Decoding is local — never paste production tokens into a server-side tool.

How to use the JWT Decoder

  1. 1Paste a JWT (with or without the "Bearer " prefix).
  2. 2Read the decoded header and payload panels.
  3. 3Check the expiry banner to see whether the token is still valid.

Frequently asked questions

Does this verify the signature?

No. Decoding only reads the Base64URL segments. Use the JWT Inspector for a claim audit, or verify signatures on your server with the real secret.

Is it safe to paste a real token?

Everything runs in your browser and nothing is transmitted, but treat any live token as a credential and rotate it if in doubt.

What do exp, iat and nbf actually mean?

They are the standard time claims, all in Unix seconds. iat is when the token was issued, exp when it stops being valid, and nbf the earliest moment it may be used. A token can be perfectly well formed and still be rejected because the verifying server's clock disagrees with yours by more than the allowed skew, which is a surprisingly common cause of intermittent auth failures.

Why is my token rejected even though it decodes fine here?

Decoding only proves the token is well formed. Rejection usually means the signature does not match the key the server holds, the token has expired, or the issuer or audience claim is not what the server expects. All four are invisible to a decoder, which is exactly why this page cannot tell you a token is valid.