# JWT Decoder

> Decode a JWT’s header and payload and check its expiration — without sending it anywhere.

URL: https://uttir.com/jwt-decoder
Categories: developer-tools, security-tools
Privacy: Tokens are decoded locally in your browser. Paste-sensitive JWTs here safely — nothing is transmitted.

## About

A JSON Web Token packs two Base64URL-encoded JSON objects — the header and the payload — plus a signature. This decoder shows both objects as readable JSON and highlights the exp claim, telling you whether the token is expired and by how much.

Unlike web-based debuggers that ask you to paste secrets into their servers, Uttir decodes entirely client-side, making it safe for production tokens.

## How to use

1. **Paste the token** — The full header.payload.signature string.
2. **Inspect the claims** — Header and payload render as formatted JSON.
3. **Check expiry** — If an exp claim exists, a badge shows whether it is expired.

## Examples

### Typical payload

Common claims: sub (subject), name, iat (issued at).

Input:

```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```

Output:

```
{ "sub": "1234567890", "name": "John Doe", "iat": 1516239022 }
```

## FAQ

### Does this verify the signature?

No. Decoding only reads the token; verifying requires the secret or public key. Never trust an unverified token for authorization.

### What does the exp claim mean?

exp is a Unix timestamp (seconds) after which the token must be rejected. The tool shows it as a human-readable relative time.

### Is it safe to paste a real token here?

Yes — decoding happens in your browser and the token is never sent over the network. Still, treat tokens as secrets and avoid sharing them.

## Related tools

- [Base64 Decoder](https://uttir.com/base64-decoder) — Decode Base64 back into readable text, with clear errors for malformed input.
- [JSON Formatter](https://uttir.com/json-formatter) — Format, beautify, and validate JSON with adjustable indentation — instantly in your browser.
- [Unix Timestamp Converter](https://uttir.com/unix-timestamp-converter) — Convert Unix timestamps to readable dates and back, with a live current-time readout.
- [HTTP Status Code Lookup](https://uttir.com/http-status-codes) — Look up any HTTP status code from 100 to 511 with plain-language explanations, searchable and filterable by category.

---

For the full HTML page with the live tool, visit https://uttir.com/jwt-decoder.
This file is the markdown rendering at https://uttir.com/jwt-decoder.md. See https://uttir.com/llms.txt for a site-wide summary.