JWT Decoder
Decode a JSON Web Token to read its header and claims, with readable issue and expiry times. Tokens are decoded locally and never sent anywhere.
Runs in your browser. Nothing is uploaded.
About the JWT Decoder
A JSON Web Token (JWT) is a compact, signed token that many sign-in systems and APIs use to carry identity and permissions. It has three parts separated by dots: a header describing the algorithm, a payload of claims such as the user ID and expiry time, and a signature.
The header and payload are only Base64URL-encoded, not encrypted, so anyone holding a token can read them. Decoding is useful when debugging authentication: checking which scopes a token grants, whether it has expired, or which issuer and audience it was made for. Because the decoding happens in your browser, the token is never sent to a server, which matters since a valid token can grant access to an account.
How to use the JWT Decoder
- 1
Paste a token into the input panel. A leading “Bearer ” is removed for you.
- 2
The header and payload are decoded straight away and shown as formatted JSON.
- 3
The status bar shows when the token was issued and when it expires, and warns if it has expired or is unsigned.
- 4
Switch the output to Tree to browse nested claims and copy any value.
Examples
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiI0MiIsInNjb3BlIjoicmVhZDpvcmRlcnMiLCJpYXQiOjE3MDQwNjcyMDAsImV4cCI6MTcwNDA3MDgwMH0.k7-PWNqLx40yD4h9J3DnTtmMcrGk0ZunfPgqt6-5ZN0{
"header": {
"alg": "HS256",
"typ": "JWT"
},
"payload": {
"sub": "42",
"scope": "read:orders",
"iat": 1704067200,
"exp": 1704070800
},
"signature": "k7-PWNqLx40yD4h9J3DnTtmMcrGk0ZunfPgqt6-5ZN0"
}Good to know
- The signature is not verified: verifying needs the secret or public key, which should never be pasted into a website. Treat decoded claims as unconfirmed.
- Encrypted tokens (JWE, five parts) cannot be read without the key and are reported as such.
- Expiry is checked against your device clock, so a wrong system time gives a wrong result.
Frequently asked questions
Is it safe to paste a real token here?
Decoding happens entirely in your browser and nothing is sent or stored. Still, a valid token is a credential: avoid sharing screenshots of it, and prefer expired or test tokens when you can.
Why does the tool not check the signature?
Checking a signature needs the signing secret (HS256) or the issuer’s public key (RS256, ES256). Your server should do that. This tool is for reading what a token claims, which is what you need while debugging.
What do iat, exp and nbf mean?
They are Unix timestamps in seconds: iat is when the token was issued, exp when it stops being valid, and nbf the time before which it must not be accepted. The status bar shows them as UTC dates.
Is my code uploaded to a server?
No. Processing happens entirely in your browser, in a background thread. Your input is never sent to our servers or stored anywhere.
Related tools
More tools that pair well with this one.