JWT Decoder
A JWT is three dot-separated parts: header, payload and signature. This tool decodes the header and payload and shows exp, iat and nbf in UTC and local time. It does not verify the signature.
How to use
- Paste the token into the box. A leading Bearer, quotes and line breaks are ignored.
- Read the header and payload as formatted JSON. Press Copy to copy either one.
- Check the badge and the time claims. exp, iat and nbf are shown in UTC and in your local time, with how long ago or how far ahead they are.
- No token handy? Press Load example to try a made-up one.
How it works
A JWT is three parts separated by dots: header, payload and signature. The header and payload are JSON text encoded as base64url, which is base64 with - and _ in place of + and /, and no = padding. The tool reverses that encoding, reads the bytes as UTF-8 and prints the JSON with indentation.
exp, iat and nbf are numbers of seconds since 1 January 1970 UTC. exp is when the token expires, iat is when it was issued, and nbf is the earliest time it is valid. The badge follows the standard rule: a token is expired when the current time is at or after exp, and not yet valid when the current time is before nbf. Your device clock is used for now.
The signature is shown as the raw text from the token. This tool does not verify it. Decoding only needs the token, but checking the signature needs the secret or public key, and only your server should do that.
Common claims
| Claim | Meaning |
|---|---|
| iss | Issuer: who created the token |
| sub | Subject: who the token is about, often a user ID |
| aud | Audience: who the token is meant for |
| exp | Expiration time, in seconds since 1970 UTC |
| nbf | Not before: the token is not valid earlier than this |
| iat | Issued at: when the token was created |
| jti | Token ID: a unique identifier for this token |
FAQ
Does this verify the signature?
No. It only decodes the header and payload. Anyone can decode a JWT, and anyone can write one with any contents, so never trust a token because it decodes correctly. Verify the signature on your server with the correct key.
Is my token sent anywhere?
No. Decoding runs in your browser and nothing is uploaded. Even so, treat real tokens as passwords: do not paste a live production token into a tool you do not trust.
Why does it say Expired when the token worked a minute ago?
The badge compares exp to the clock on this device. If your device clock is wrong or the server allows some clock skew, the two can disagree for a short time.
What does alg none mean?
It marks an unsecured token with no signature. A server must reject it unless it deliberately accepts unsigned tokens, which is rare. The tool shows a warning when it sees it.
Is the payload encrypted?
No. A normal signed JWT is only encoded, so anyone holding it can read the payload. Do not put secrets in it. Encrypted tokens (JWE) have five parts and cannot be read by this tool.