# JWT decoder

> Decode a JSON Web Token to see its header, claims and issued/expiry times in readable dates. Runs in your browser; the token is never sent or stored.

URL: https://tools.cuelark.com/jwt-decoder
Publisher: Cuelark Team (https://cuelark.com)
Updated: 2026-11-10
Price: free, no sign-up
Privacy: runs in the browser; files are not uploaded

Paste a JSON Web Token to read its header and payload as formatted JSON, with iat, nbf and exp turned into dates. Decoding happens in this tab, so the token never leaves your device.

## How to use it

1. Paste the token (a leading 'Bearer ' is removed).
2. Read the algorithm, the claims and the times in UTC.
3. Copy the decoded JSON or download it.

## Details

- **Format:** header.payload.signature, each Base64URL
- **Times:** iat, nbf and exp shown as ISO 8601 UTC
- **Signature:** Not verified: decoding needs no key, verification does

## Questions

### Does decoding a JWT mean it is valid?

No. Anyone can decode a JWT; the payload is only Base64URL. Trust it only after verifying the signature with the issuer's key, and checking exp, iss and aud.

### Is it safe to paste a production token here?

The token is decoded in your browser and never sent, saved or added to the URL. Still, treat live tokens like passwords and prefer expired or test tokens.

### Why does it say the token is expired?

The exp claim is a Unix time in seconds. If it is in the past, servers should reject the token. Check your clock and the token's lifetime.

### Can it decode encrypted JWTs (JWE)?

No. A JWE has five parts and its payload is encrypted, so it can't be read without the key. This tool reads signed JWTs (JWS) with three parts.

### Is my input sent anywhere?

No. It is processed by code running in this tab. Nothing is uploaded, logged or saved; tokens, hashes and text are never put in the page address.

### Can an AI agent use this?

Yes. The same function is a tool on our free MCP server at tools.cuelark.com/mcp, so ChatGPT, Claude or Cursor get exactly the answer this page shows. 'Copy MCP call' gives you the arguments.

## Related tools

- [Base64 encode and decode](https://tools.cuelark.com/base64-encode-decode)
- [Unix timestamp converter](https://tools.cuelark.com/unix-timestamp-converter)
- [Hash generator (SHA-256, MD5)](https://tools.cuelark.com/hash-generator)
- [UUID generator](https://tools.cuelark.com/uuid-generator)