JWT Decoder
Decode JWT headers, payloads, and expiry claims locally.
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjMiLCJuYW1lIjoiQWRhIExvdmVsYWNlIiwiaXNzIjoiZGV2dG9vbHNodWIiLCJpYXQiOjE3MDAwMDAwMDAsImV4cCI6MTcwMDAwMzYwMH0.7yQqLNzBdz6Wa8wLFhk3QgvI9VOhGZqQmH1BpCzXMto
- Algorithm alg
- HS256
- Type typ
- JWT
- Issuer iss
- devtoolshub
- Subject sub
- 123
- Issued at iat
- 2023-11-14 22:13:20 UTC (2 years ago)
- Expires exp
- 2023-11-14 23:13:20 UTC (2 years ago)
{
"alg": "HS256",
"typ": "JWT"
}{
"sub": "123",
"name": "Ada Lovelace",
"iss": "devtoolshub",
"iat": 1700000000,
"exp": 1700003600
}- This token expired 2 years ago (2023-11-14 23:13:20 UTC).
How it works
A JWT is three Base64URL segments separated by dots: a header that names the signing algorithm, a payload of claims, and a signature over the first two. Decoding the first two segments is all it takes to read what a token asserts.
The header and payload are decoded and pretty-printed as JSON, and the signature is shown as it appears in the token. Alongside them, the registered claims are read out: iss, sub, aud, and jti as they stand, and iat, nbf, and exp as UTC timestamps with how long ago or how far ahead they fall, so a token is marked active, expired, or not valid yet.
Decoding is not verification. The signature is never checked, so a decoded payload tells you what a token claims, not whether the claim can be trusted. The expiry status shown here is read from the payload for the same reason: it reports what the token says about itself. Tokens that are unsigned, carry no exp, or hold a malformed timestamp are called out as warnings.
Frequently asked questions
- Does this tool verify the JWT signature?
- No. It decodes the header and payload only. Verifying a signature requires the issuer's secret or public key, and checking it here would mean handling that key, which the tool deliberately avoids.
- Is a JWT encrypted?
- A standard signed JWT is not. The payload is Base64URL-encoded, which anyone can decode, so it must never carry passwords or secrets. The signature protects against tampering, not against reading.
- What do exp, iat, and nbf mean?
- They are registered claims holding Unix timestamps: iat is when the token was issued, exp when it expires, and nbf the earliest time it may be accepted. All three are rendered here as UTC dates with a relative description, so there is no need to convert the numbers by hand.
- Why does my token fail to decode?
- Most often a segment was truncated when copying, or a prefix such as "Bearer " was included. A JWT must be exactly three dot-separated Base64URL segments with nothing around them.
- Is it safe to paste a production token here?
- Decoding happens entirely in your browser and the page makes no network requests, so the token is never transmitted. It is still worth revoking any token you have pasted into a tool you do not control.