JWT Decoder
Decode a JWT to read its header, payload claims and signature, with exp, nbf and iat shown as dates and an expiry status. Runs locally; nothing is uploaded.
A leading "Bearer " is removed automatically.
{
"alg": "HS256",
"typ": "JWT"
}{
"sub": "1234567890",
"name": "John Doe",
"iat": 1516239022
}| Algorithm | HS256 |
|---|---|
| Signature | SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c |
What is JWT Decoder?
The JWT decoder splits a JSON Web Token into its header, payload and signature and pretty-prints the JSON. Time claims (exp, nbf, iat) are converted to readable UTC dates with relative times, and a status badge tells you whether the token is expired, not yet valid or has no expiry. It decodes only – it does not verify the signature.
How to use JWT Decoder
- Paste the token (a leading
Beareris removed automatically). - Read the decoded header (algorithm, type, key ID) and payload claims.
- Check the expiry status and the exp/nbf/iat dates.
- Use the JWT Verifier with the right key before trusting any claim.
Example
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
Header {"alg": "HS256", "typ": "JWT"} · payload {"sub": "1234567890", "name": "John Doe", "iat": 1516239022} · status: no expiration When to use JWT Decoder
Use it to debug authentication: check which claims, scopes, audience or expiry a token carries. Do not treat decoded claims as trustworthy – anyone can create a token with arbitrary content. Encrypted tokens (JWE, five parts) cannot be decoded without the key.
How JWT Decoder works
A compact JWS has three Base64URL parts separated by dots. The first two are decoded (Base64URL → bytes → UTF-8) and parsed as JSON; the third is shown as-is because it is binary signature data. Time claims are NumericDate values (seconds since 1970-01-01 UTC) and are compared with your device's clock. Nothing leaves your browser.
Common Use Cases
- Find out why an API returns 401: is the token expired or for the wrong audience?
- Read the roles or scopes inside an access token.
- Check the kid in the header to see which signing key was used.
- Inspect ID tokens from an OpenID Connect provider.
Security Note
Decoding happens in your browser only. Treat JWTs like passwords: anyone holding a valid token can use it until it expires.
FAQs
Is it safe to paste a production token?
The token is decoded locally and never sent anywhere. Still, a valid token is a credential – revoke it if you shared it somewhere you do not control.
Why is decoding not verification?
The payload is only Base64URL-encoded, not encrypted. Verification requires checking the signature with the secret or public key.
What do exp, nbf and iat mean?
exp is the expiry time, nbf "not before" (the token is invalid earlier), and iat the time it was issued – all in seconds since the Unix epoch.