JWT Decoder
Decode JSON Web Tokens to view header, payload, and expiry information.
Decodes a JSON Web Token (JWT) to show its header and payload as readable JSON, with its issue and expiry times spelled out. Decoding happens in your browser, so the token is never sent anywhere — still, treat real tokens like passwords.
How to use it
Paste the token — three parts separated by dots — or a whole Authorization value: a leading Bearer is dropped. The header and payload appear below it. Under the payload, the iat, nbf and exp claims are shown in UTC with how long ago or how far ahead they are, and the token is marked Expired from its exp time on, or Not yet valid before its nbf time, by your device's clock.
Pretty JSON indents the output. Trim input removes all spaces and line breaks from the token, so a token copied across lines still decodes.
What decoding does and does not tell you
A JWT's header and payload are Base64URL-encoded JSON, not encrypted: anyone holding the token can read them, which is all this tool does. The signature, the third part, is what proves the token was issued by someone holding the key.
This decoder does not verify the signature. A token that decodes cleanly can still be forged or tampered with; only the server that checks the signature can trust its contents. Never put secrets in a JWT payload.
Examples
Reading a token
- Token
- eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkFubmEiLCJpYXQiOjQxMDI0NDEyMDAsImV4cCI6NDEwMjQ0NDgwMH0.c2lnbmF0dXJl
- Header
- {"alg":"HS256","typ":"JWT"}
- Payload
{ "sub": "1234567890", "name": "Anna", "iat": 4102441200, "exp": 4102444800 }
Its exp of 4102444800 is 1 January 2100, 00:00:00 UTC: 60 minutes after it was issued (iat).
Standard claims
| Claim | Name | Meaning |
|---|---|---|
iss | Issuer | Who created the token |
sub | Subject | Who the token is about, usually a user ID |
aud | Audience | Who the token is meant for |
exp | Expiration time | When it stops being valid, in seconds since 1970 (UTC) |
nbf | Not before | When it starts being valid |
iat | Issued at | When it was created |
jti | JWT ID | A unique ID, used to prevent reuse |
See also
- Base64 Encoder & Decoder — to decode a single Base64URL part by hand.
- JSON Formatter & Minifier — to format a large payload.