JWT Decoder

Paste a JWT to see its header, payload and expiry in plain language. Nothing leaves your browser.

Encoded token
Decoded
Ready

What is inside a JWT?

A JSON Web Token (JWT, defined in RFC 7519) is a compact way to pass signed claims between systems, most often as an access token in an Authorization: Bearer … header. It has three parts separated by dots:

  1. Header — which algorithm signed the token (alg, e.g. HS256, RS256, ES256) and the token type.
  2. Payload — the claims: who the token is about, who issued it, and when it expires.
  3. Signature — proof that the header and payload were created by someone holding the key.

The header and payload are only Base64url-encoded, not encrypted. Anyone who has the token can read them, which is exactly what this decoder does. Never put passwords or other secrets in a JWT payload.

Standard claims

ClaimNameMeaning
issIssuerWho created the token, e.g. your auth server URL
subSubjectWho the token is about, usually a user ID
audAudienceWhich API or app the token is meant for
expExpirationUnix time after which the token must be rejected
nbfNot beforeUnix time before which the token is not valid
iatIssued atUnix time when the token was created
jtiJWT IDUnique ID, used to prevent replay

Time claims are seconds since 1 January 1970 UTC. The decoder converts them into readable UTC dates and tells you how long ago the token was issued and whether it has already expired — the most common reason an API suddenly answers 401 Unauthorized.

Decoding is not verifying

This tool shows what a token says, not whether it is genuine. Verification checks the signature with the secret (HMAC) or public key (RSA/ECDSA), and must happen on your server using a maintained JWT library. Your server should also reject tokens with "alg": "none" and check exp, iss and aud. The decoder flags unsigned tokens so you notice them.

Is it safe to paste a token here?

Decoding happens entirely in your browser; the token is not uploaded or logged. Still, treat production tokens like passwords: they grant access until they expire. Prefer test tokens, and avoid pasting live tokens into any site you do not trust.

Frequently asked questions

Can I decode a JWT without the secret key?
Yes. The header and payload are just Base64url-encoded JSON, so they can be read without any key. The key is only needed to verify the signature.
Why does my API say the token is invalid when it decodes fine?
Common reasons are an expired exp claim, a wrong audience (aud) or issuer (iss), clock skew between servers, or a signature made with a different key. Check the times shown in the decoder first.
What does "encrypted JWE token" mean?
A token with five parts is a JSON Web Encryption token. Its payload is encrypted, so it cannot be read without the decryption key.
Does this tool verify signatures?
No. It decodes only. Signature verification needs your secret or public key and should be done on your server with a trusted library.

Related tools

Base64 Encode/Decode, JSON Formatter, Hash Generator, UUID Generator.