JWT Decoder
Paste a JWT and see its contents, when it expires and which algorithm it uses.
- Never leaves your device
- No sign-up
The token is decoded in your browser and never sent anywhere. The signature isn't verified: that requires the secret key.
Quick answer: To decode a JWT, paste the token (with or without "Bearer") into the box. You'll see the header (algorithm and type), the payload with its claims and the issued and expiration dates in readable form. The signature isn't verified, since that requires the secret key.
How to do it in 3 steps
- 1Paste the JWT.
- 2See the header and payload.
- 3Check the expiration.
Why use Pronto Arquivo
Readable expiration
Turns exp and iat into a date and time and warns you if it has expired.
Secure
The token never leaves your browser, unlike sites that send it to a server.
Accepts Bearer
You can paste the whole Authorization header.
Copy the payload
Formatted JSON, ready to copy.
Guides
Don't paste production tokens into unknown sites
Many decoders send tokens to their servers. Decoding here is local, but treat valid tokens like passwords.
Frequently asked questions
What is a JWT?
JSON Web Token: a token with a header, payload and signature separated by dots.
How do I check when a JWT expires?
The exp claim is shown as a date and time.
Does the tool verify the signature?
No; that requires the secret or public key.
Is the token sent anywhere?
No. It's decoded in your browser.
