JWT Decoder

Decode JSON Web Tokens to inspect header, payload, and signature without needing the secret key.

JWT Decoder tool

Loading...

Example

Input: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiI0MiIsIm5hbWUiOiJBZGEiLCJpYXQiOjE3MDAwMDAwMDB9.fh3sbYff532CtSqo8rSJd-47SxI8g2HhP94CYVHfg1A

Result: Header {"alg": "HS256", "typ": "JWT"}, Payload {"sub": "42", "name": "Ada", "iat": 1700000000}, Token has no expiration (exp) claim

The header and payload are Base64url-decoded JSON. The iat claim is shown as November 14, 2023 22:13:20 UTC in your local time zone, and the signature is displayed but not verified.

Standard JWT Claims

ClaimNameWhat it holds
issIssuerWho created and signed the token
subSubjectWho the token is about, usually a user ID
audAudienceWhich service the token is meant for
expExpiration timeUnix time after which the token is invalid
nbfNot beforeUnix time before which the token is not valid
iatIssued atUnix time when the token was created
jtiJWT IDA unique ID, used to stop reuse

Registered claims from RFC 7519. This tool shows exp, nbf and iat as dates.

  1. Paste your complete JSON Web Token (the long string starting with "eyJ") into the input field.
  2. The decoder instantly splits the token into its three parts: header, payload, and signature.
  3. Review the decoded header to see the signing algorithm and token type.
  4. Examine the payload claims including subject, issuer, expiration time, and custom data fields.
  5. Check the expiration status indicator to see whether the token is still valid or has expired.
  6. Click copy on any decoded section to use the parsed JSON in your debugging workflow.

What Is Inside a JSON Web Token?

A JWT decoder shows what a JSON Web Token contains. Paste a token and this tool splits it at the dots, decodes the header and payload into readable JSON, and shows the signature as it is. It also tells you whether the token has expired.

A JWT is three Base64url strings joined by dots: header.payload.signature. The header names the signing method, such as HS256 or RS256. The payload holds claims, which are simple facts such as the user ID (sub) or the expiry time (exp). The signature proves that the first two parts were not changed, but only to someone who has the key. Base64url is an encoding, not encryption, so anyone holding a token can read its payload. That is why decoding needs no secret, and why a JWT should never carry passwords or other secrets. It also means this tool cannot tell you whether a token is genuine. It does not check the signature. Your server must do that with the secret or public key.

Time claims are Unix timestamps in seconds. The tool turns iat (issued at), nbf (not before) and exp (expires) into dates in your time zone and shows a status: expired, not valid yet, valid, or no exp claim. Decoding happens in your browser, but treat live tokens with care anyway, since a stolen token works like a password until it expires. To convert other timestamps, use the Unix Timestamp Converter, and to decode plain Base64, use Base64 Encode and Decode.

Sources

Frequently Asked Questions

Yes. The header and payload are only Base64url encoded, so anyone can read them without a key. The key is needed only to create a valid signature or to check one. This is why sensitive data should not be stored in a JWT payload.
No. Verifying needs the shared secret (for HS256) or the issuer's public key (for RS256 and ES256), and a check against it on your server. This tool only decodes and displays the three parts, so a forged token with a made-up signature will decode just as cleanly as a real one.
A JWT must have exactly three parts separated by dots. Common causes of errors are copying the Bearer prefix from an Authorization header, cutting the token short, or pasting an encrypted token (JWE), which has five parts. Remove anything before the first eyJ and paste the full token again.
The tool compares the exp claim, a time in seconds, with the clock on your device. If exp is in the past, the token is expired and a server will reject it too. Access tokens often last only 5 to 60 minutes. If the times look hours off, check your device clock and remember the dates are shown in your local time zone.
HS256 signs with one shared secret, so every service that verifies tokens must hold the same secret. RS256 signs with a private RSA key and verifies with the matching public key, so other services can check tokens without being able to create them. The alg field in the header tells you which one a token uses.
Those are Unix timestamps, counting seconds since January 1, 1970, UTC. JWTs use them for exp, iat and nbf because they are short and free of time zones. This decoder converts those three claims into readable dates above the header. Any other numeric claims are shown as raw numbers, so convert them with a timestamp tool if needed.

Related Tools

Base64 Encode and Decode

Encode text to Base64 and decode Base64 strings back to readable text, with full UTF-8 support.

Developer Tools

JSON Formatter and Validator

Format, validate, beautify, and minify JSON data with a collapsible tree view and line-and-column error detection.

Developer Tools

Hash Generator

Generate MD5, SHA-1, SHA-256, SHA-384, and SHA-512 hashes from text or files right in your browser.

Developer Tools

Unix Timestamp Converter

Convert Unix timestamps to human-readable dates and dates back to Unix timestamps instantly.

Developer Tools

Basic Auth Generator

Generate Base64-encoded Basic Authentication headers from username and password credentials.

Security and Encryption

Text Encryption and Decryption

Encrypt and decrypt text using AES-256 encryption entirely in your browser. No data sent to servers.

Security and Encryption