JWT decoder
Paste a JWT to see what is inside its header and payload, with the exp, nbf and iat claims turned into UTC dates. This tool only decodes the token; it does NOT check the signature, so it cannot tell you the token is genuine.
Runs in your browser: nothing you enter is sent anywhere.
How to use it
- Paste the token, copied from an
Authorization: Bearer … header or a cookie.
- Read the header (algorithm and token type) and the payload (claims) in the result.
- Check the dates for
exp, nbf and iat, shown in UTC.
How it works
A JWT is three Base64URL strings joined with dots: header.payload.signature. The first two are JSON documents; this tool decodes them as UTF-8 text and formats them. The third is the signature, which is shown as it is and never checked.
Example: the token starting eyJhbGciOiJIUzI1NiIs… has the header {"alg":"HS256","typ":"JWT"} and the claim iat 1516239022, which is 18 January 2018, 01:30:22 UTC.
Tips
- An
exp in the past means the server should reject the token; compare it with the current date yourself, because this page does not judge validity.
- The header’s
alg tells the server how the signature was made. Servers should use their own fixed list of accepted algorithms rather than trusting this field blindly.
- To read the raw parts yourself, use the Base64 decoder with its URL-safe option.
Frequently asked questions
Does this tool verify the signature?
No. It only decodes the first two parts. Verifying needs the secret or public key and must be done by your server. Anyone can create a token with any content, so decoded claims prove nothing by themselves.
Is it safe to paste my token here?
Decoding happens in your browser and the token is not sent anywhere. Even so, a live token can grant access, so prefer expired or test tokens and avoid sharing production ones.
What are exp, nbf and iat?
These are registered claims from RFC 7519. exp is the time after which the token must not be accepted, nbf the time before which it must not be accepted, and iat the time it was issued. All are seconds since 1 January 1970 UTC, shown here as dates.
Why does my token fail to decode?
A JWT must have exactly three dot-separated parts, and the first two must be Base64URL text containing JSON. Encrypted tokens (JWE) have five parts and cannot be read this way. A leading "Bearer " prefix is accepted and removed.
Is a JWT encrypted?
A normal signed JWT is only encoded, not encrypted. Anyone who has it can read the header and payload, so do not put secrets in it.