Developer Tools
JWT Decoder
Paste a JWT to decode its header and payload and read its claims, including human-readable issued and expiry times. Decoding only — your token stays in your browser.
{
"alg": "HS256",
"typ": "JWT"
}{
"sub": "1234567890",
"name": "John Doe",
"iat": 1516239022
}Issued (iat): Thu, 18 Jan 2018 01:30:22 GMT
A signature segment is present (43 characters), but it is notverified — this tool only decodes. Never paste production tokens you don't want exposed. Everything stays in your browser.
How to decode a JWT and read its claims
- Paste the token into the box. It opens with the well-known HS256 example token so you can see the layout. Remove any Bearer prefix or surrounding quotes first.
- There is no button: as soon as the text is a decodable token, the Header pane and the Payload pane appear side by side as pretty-printed JSON.
- If the payload has numeric iat, nbf or exp claims, a box underneath converts them to UTC dates and marks exp as expired when it is in the past.
- If the text cannot be decoded, a red line asks for a valid JWT with two or three dot-separated parts. Check that the token is complete and uncorrupted.
The three parts of a token
A JSON Web Token (RFC 7519) is three strings joined by dots: a header, a payload and a signature. The first two are JSON objects encoded with base64url, the URL-safe alphabet from RFC 4648 section 5 with the padding removed. The signature is raw bytes, not JSON, produced by the algorithm named in the header. In the sample token the header decodes to an object with alg HS256 and typ JWT, the payload holds a sub of 1234567890, the name John Doe and an iat of 1516239022, and the 43-character signature is a 32-byte HMAC-SHA256 tag.
What the decoder does with your paste
- Trims the text and splits it on dots. Two parts (header and payload) or three (with a signature) are accepted; any other count is rejected. The signature is never decoded or verified, but the note under the panes says whether a signature segment is present and how many characters it holds, or that the token has none.
- Converts each of the first two parts from base64url to standard Base64 (minus to plus, underscore to slash), restores the padding, decodes to UTF-8 and parses the JSON.
- Pretty-prints both objects with two-space indentation. If either part is not valid JSON after decoding, the whole token is reported as invalid.
- Looks for iat, nbf and exp. When the value is a number it is multiplied by 1,000 and shown with toUTCString; a string value is left in the payload pane only.
- Compares exp with the current time on your device and appends a red expired marker when the moment has passed. There is no allowance for clock skew.
Registered claims you will see in the payload
The sample's iat of 1516239022 displays as Thu, 18 Jan 2018 01:30:22 GMT. Everything else, such as scopes, roles, email or tenant ids, is a private or public claim the issuer chose, and it appears exactly as encoded.
| Claim | Meaning (RFC 7519 §4.1) | How this tool shows it |
|---|---|---|
| iss | Issuer: who created the token | Raw value in the payload pane |
| sub | Subject: the user or principal | Raw value in the payload pane |
| aud | Audience: who may accept it | Raw value (a string or an array) |
| exp | Expiration time, seconds since epoch | UTC date plus an expired flag if past |
| nbf | Not before: invalid until this time | UTC date |
| iat | Issued at | UTC date |
| jti | Unique token id, for revocation lists | Raw value in the payload pane |
Why decoding tells you nothing about trust
Base64url is an encoding, not encryption, so anyone can read a token and anyone can build one with any claims they like. The signature is what makes a token trustworthy, and checking it needs the issuer's secret (for HS256) or public key (for RS256, ES256 and friends). This tool never performs that check: a token whose payload was edited, or whose header says alg none, decodes just as cleanly as a genuine one. The note under the panes reports only that a signature segment exists and its length, never whether it is correct. Verify on the server with a JOSE library, and treat what you read here as unverified input.
Questions the decoder answers quickly
- Why an API returned 401: look for an exp in the past or an nbf in the future.
- Which key signed it: the kid header value tells you which entry in the issuer's JWKS to use.
- Whether the right scopes or roles were issued, before you debug the authorisation code that reads them.
- How old a session is, from iat, and which tenant, client or audience it was minted for.
Tokens it cannot read
Encrypted tokens (JWE) have five dot-separated parts, so the part count alone rejects them before anything is decoded; even split differently, their second part is a wrapped key rather than JSON. Opaque access tokens issued by some providers are random strings with no dots and cannot be decoded by anything. Times are only ever displayed in UTC; convert with the timestamp tool if you need your local zone.
Frequently asked questions
Does this verify the token's signature?
No. It only decodes the header and payload so you can read them. Verifying the signature requires the secret or public key and should be done on your server.
Is it safe to paste my token here?
Decoding happens entirely in your browser and nothing is sent anywhere. Still, avoid pasting sensitive production tokens into any online tool as a general security habit.
Why does it say my token is invalid?
Common causes are a Bearer prefix or quotation marks copied along with the token, a header or payload truncated by a log viewer, or a five-part JWE token. The first two parts must decode to JSON objects and there can be no more than three parts.
Is the expiry time shown in my local time zone?
No, all three dates are shown in UTC with a GMT suffix. The expired check itself uses your device clock, so it is correct regardless of zone.
What does alg none in the header mean?
It declares an unsigned token. Any server that accepts it is misconfigured, since the payload could have been written by anyone. The decoder shows it like any other header.
Can I edit the payload and get a new token?
Not here, and a changed payload would fail signature verification anyway. To issue tokens you need the signing key and a library that implements the algorithm.
Explore
113 tools. Zero uploads. One place.
Every tool opens instantly, works on your phone and keeps your files on your device.
JWT Decoder guides
Related tools
JSON Formatter
Developer Tools
Format, validate and minify JSON instantly.
Open toolBase64 Encode / Decode
Developer Tools
Encode text to Base64 or decode it back.
Open toolURL Encode / Decode
Developer Tools
Percent-encode or decode URLs and query strings.
Open toolUUID Generator
Developer Tools
Generate random UUID (v4) identifiers in bulk.
Open tool