JWT Decoder
Decode a JSON Web Token to read its header, payload and expiry time.
About this tool
Splits the token into its three parts, decodes the Base64URL header and payload, and formats them as JSON. Time claims such as exp and iat are shown as dates in your time zone. The signature is not verified, and the token never leaves your browser.
A JSON Web Token (JWT) is a compact string that apps and APIs use to carry login sessions and permissions. It looks like random characters, but the first two parts are just encoded JSON that anyone can read. Paste a token to see its header and payload neatly formatted, which signing algorithm it uses, when it was issued and when it expires. Decoding happens entirely in your browser.
How to use the JWT Decoder
- Copy the token, for example from an Authorization header or your browser’s developer tools. A leading Bearer is removed for you.
- Paste it into the box.
- Read the algorithm, the expiry time and the issued-at time.
- Check or copy the decoded header and payload.
Reading the sample token
The sample token’s header decodes to {"alg":"HS256","typ":"JWT"}, so it claims to be signed with HMAC SHA-256. The payload holds a subject (sub) of 1234567890, a name, an issued-at time (iat) of 1790000000 and an expiry (exp) one hour later at 1790003600. Those are Unix timestamps in seconds, which the decoder shows as readable dates. The third part is the signature, which this tool does not check.
How a JWT is built
A JWT has three parts separated by dots: header.payload.signature. The header and payload are JSON objects encoded with Base64URL, a version of Base64 that is safe in URLs. The header names the signing algorithm, such as HS256 or RS256. The payload holds claims: registered ones like iss (issuer), sub (subject), aud (audience), exp (expiry) and iat (issued at), plus any custom data. The signature is made from the first two parts and a secret or private key, so a server can tell if the token was changed. Encoding is not encryption: anyone holding the token can read the payload, so never put passwords or other secrets in it. Verifying the signature needs the key and should be done on your server.
Frequently asked questions
Is it safe to paste a JWT here?
The token is decoded in your browser and is not sent anywhere. Even so, treat live tokens like passwords: anyone who has one may be able to use it until it expires.
Does this verify the signature?
No. Verifying needs the secret or public key and belongs on your server. This tool only decodes the readable parts.
Why does my token show as expired?
The exp claim is earlier than the current time on your device. Tokens are often short-lived, from minutes to hours, and are refreshed automatically by apps.
What does alg none mean?
The token is unsigned. Servers should reject such tokens, because anyone could have created or edited them.