JWT Decoder
Decode a JSON Web Token to read its header and claims, with expiry status. Decoding only, nothing leaves your browser.
Decode a JSON Web Token to inspect its header and payload. Decoding only - the signature is not verified, and nothing leaves your browser.
Token summary
- Subject
- 1234567890
- Claims
- 3
Signature is not verified - never trust a decoded token for authorisation.
{
"sub": "1234567890",
"name": "Jane Doe",
"iat": 1516239022
}Overview
A JWT is three Base64url segments separated by dots: header, payload and signature. The first two are only encoded, not encrypted, so anyone holding the token can read them. That is by design, and it is why you must never put secrets in a JWT payload.
This tool decodes and shows the claims plus whether the token has expired. It does not verify the signature, because that needs the secret, and pasting a signing secret into a web page is exactly what you should not do.
The claims with three-letter names are the registered ones from the spec: iss is who issued the token, sub is who it is about, aud is who it is for, exp is when it stops being valid, and iat is when it was issued. The tool reads exp and iat as Unix seconds and shows them as real times, which is usually the first thing you actually want to know.
Step by step
- 1Paste the token.
- 2Read the summary for subject and expiry.
- 3Switch between the payload and header tabs.
- 4Check exp against the current time.
Notes
- Decoding is pure Base64url, so a malformed or truncated token shows a clear parse error rather than a wrong but plausible-looking result.
- An expired token is not necessarily a broken one. Many flows expect a short-lived access token to expire and be refreshed, so exp being in the past can be entirely normal.
- The signature segment is shown but not interpreted. It is a hash, not data, and only your server with the secret can judge whether it is valid.
FAQ
Is the signature verified?
No, and deliberately so. Verifying requires the signing secret, and that should never be pasted into a browser tool. Verify on your server.
Is it safe to paste a token here?
Decoding happens entirely in your browser, so nothing is transmitted. Even so, treat a live token as a credential and prefer an expired or test one.
Why can anyone read the payload?
JWTs are signed, not encrypted. Signing proves the contents were not tampered with; it does not hide them. Never store secrets in the payload.
Why does exp look like a huge number?
It is a Unix timestamp, the count of seconds since 1970. This tool converts it to a readable date and tells you whether that moment is in the past.
What is the alg in the header?
The signing algorithm, such as HS256 or RS256. It matters for verification on your server. Be wary of a token whose alg is none, which claims to need no signature at all.