JWT Decoder
Paste a JSON Web Token to read its header and payload, see when it expires in plain language, and optionally check its signature. Free, and your token never leaves your browser.
How to decode a JWT
Paste the token into the box. If you copied it from an Authorization header, the word Bearer is fine. The page splits it into its parts, decodes the header and payload, and shows them as formatted JSON with colours. Below them, a table explains the standard claims in plain English, and a banner at the top says whether the token has expired or is not valid yet. Press Sample to see a working example you can experiment with.
What is inside a token
- Header: usually the signing algorithm (
alg) and the type (typ). A key ID (kid) tells the server which key to use. - Payload: the claims. Common ones are
sub(who the token is about),iss(who issued it),aud(who it is for),exp,nbfandiat(times), andscopeor roles for permissions. - Signature: proves the first two parts have not been changed. It cannot be read like the other parts; it can only be checked with the correct key.
Reading the expiry and dates
JWT times are whole seconds since 1 January 1970 in UTC. The page shows each one as a date in UTC, the same moment in your own time zone, and how long ago or how far ahead it is. If a time looks absurdly far in the future, it was probably written in milliseconds by mistake, and the page points that out.
Decoding is not verifying
Anyone can decode a JWT, because the header and payload are only Base64url text. That is useful for debugging, but it does not tell you the token is genuine. To check the signature, enter the key under Verify signature: the shared secret for HS256, HS384 or HS512, or the public key in PEM form for RS and ES algorithms. The check runs in your browser using its built-in cryptography, and the key is not sent anywhere. In production, always verify tokens on your server, check the issuer and audience, and reject unsigned tokens.
Common problems
| Problem | Usual cause |
|---|---|
| “Not a valid JWT” | A part is missing, the token was cut when copying, or it has quotes and extra text around it |
| Token looks expired but should not be | Wrong clock on your device or the server, or you are looking at an old token |
| Signature does not match | Wrong secret or key, key encoding mismatch, or the token was edited |
| Five parts instead of three | Encrypted JWT (JWE), which needs the private key to read |
| alg is none | Unsigned token, which a server should refuse to trust |
Privacy
Decoding and verification run entirely in your browser. The token and any key you type are not uploaded, logged or stored. Treat real tokens carefully anyway: until they expire they can act like a password for the account they belong to.
Frequently asked questions
Is it safe to paste my JWT here?
The token is decoded in your browser and is never sent to a server, so nothing leaves your device. Even so, a live access token is like a password until it expires, so avoid pasting production tokens into any website you do not trust and prefer test or expired tokens when you can.
What is a JWT?
A JSON Web Token is a compact string with three parts separated by dots: a header (the signing method), a payload (the claims, such as who the user is and when the token expires) and a signature. It is used for sign-in sessions and API access.
Does decoding a JWT prove it is valid?
No. Decoding only reads the contents, and anyone can do that because the header and payload are just Base64url text. A token is trustworthy only when its signature has been verified with the right key, by the server that is going to rely on it. This page shows you the contents and can check a signature if you supply the key, but a decoded token alone proves nothing.
Why can anyone read the payload?
JWTs are signed, not encrypted. The signature stops people changing the contents without detection, but it does not hide them. Do not put secrets, passwords or sensitive personal data in a JWT payload.
What do exp, iat and nbf mean?
They are times written as seconds since 1 January 1970 (UTC). exp is when the token expires, iat is when it was issued, and nbf (not before) is the earliest time it may be used. This page converts them to readable dates in UTC and in your own time zone and says whether the token has expired.
The page says my token is expired. What now?
The server that issued it decided on that expiry time. You normally ask the sign-in service for a new token, often with a refresh token. If you think it should still be valid, check that your device clock is correct, because a clock that is wrong by several minutes can make a fresh token look expired.
What does alg “none” mean?
It means the token has no signature at all. Anyone could create such a token with any contents. A properly configured server rejects it. If you see it in a token your system accepts, treat that as a security problem.
Which signature algorithms can I verify?
HS256, HS384 and HS512 with a shared secret, RS256, RS384 and RS512 with an RSA public key, and ES256, ES384 and ES512 with an elliptic-curve public key (PEM format, starting with BEGIN PUBLIC KEY). The check runs locally using your browser’s built-in cryptography. PS256 and EdDSA tokens can be decoded but not verified here.
Why does verification say the signature does not match?
The most common reasons are the wrong secret or key, a key that is Base64 encoded when the page expects plain text (or the other way round, so try the Base64 checkbox), extra spaces or line breaks in the key, or a token that was changed after it was signed.
What is a token with five parts?
That is an encrypted JWT (JWE). Its payload is encrypted, so it cannot be read without the private key. This page tells you when it sees one.
Does it work for tokens that start with Bearer?
Yes. A leading “Bearer ” from an Authorization header is removed automatically, and spaces or line breaks inside the pasted token are ignored.
Related tools
Base64 Encode & Decode JSON Formatter Password Generator All converters