JWT Decoder
Paste a JSON Web Token to inspect its header, payload, and expiry — with human-readable timestamps. Unlike jwt.io clones, decoding happens locally, so pasting production tokens is actually safe here.
Your token is decoded entirely in your browser — it never leaves your device.
Claims timeline
Signature not verified — this tool only decodes the token. Never trust the contents of an unverified JWT.
Something wrong with this tool? Tell us and we'll fix it
How to use
- Paste your JWT into the input area.
- Instantly see the decoded header and payload.
- Check expiry (exp), issued-at (iat) and not-before (nbf) as readable dates.
Frequently asked questions
Is it safe to paste a real JWT here?
Yes — the token is decoded entirely in your browser with zero network requests. Most decoder sites send your token to their servers; ToolVeil never does. You can verify this in your browser's network tab.
Does this verify the signature?
It decodes the header and payload and shows the algorithm. Cryptographic signature verification requires the secret key, which you should never paste into any website.
What do exp, iat and nbf mean?
exp is when the token expires, iat is when it was issued, nbf is "not valid before". The tool converts these Unix timestamps into readable dates and tells you if the token is already expired.