JWT Decoder
Paste a JSON Web Token and read what is in it: the header, the payload and its claims, and the exp, nbf and iat times as dates with how long ago or from now they are. This tool decodes; it does not verify. It never asks for a key, so it can say nothing about whether the signature is genuine, and it tells you so. The decoding runs in your browser, sends nothing and stores nothing. Free, no sign-up.
Before you paste a token. A token that is still valid is a password. This page sends nothing and stores nothing, but any web page you paste a live token into could in principle read it. Use a token from a test system, one that has expired, or one you have already revoked.
Decoded in your browser. A leading “Bearer ” and line breaks are ignored.
Paste a token, or load the example, to decode it.
How to Use the JWT Decoder
- 1. Choose a safe token. Use a token from a test system, one that has expired, or one you have revoked. A live token works like a password. Load the example decodes a made-up one.
- 2. Paste it. A leading
Bearer, quotes and line breaks are ignored. The three parts are decoded as you type. - 3. Read the result. The header and payload are shown as formatted JSON, the registered claims are explained, and every time claim appears in seconds, in UTC, in your time zone and relative to now.
- 4. Read the notes. They flag an unsigned token, a header that points to a key, a missing expiry, odd times and a signature of the wrong size.
What Is Inside a JWT
A JSON Web Token (RFC 7519) is usually a signed token in the JWS form (RFC 7515): three base64url strings joined by dots.
| Part | Contains | Readable by |
|---|---|---|
| Header | The algorithm (alg), the type (typ), often a key id (kid) | Anyone: it is encoded, not encrypted. |
| Payload | The claims: who the token is for, who issued it, when it expires, and whatever else the issuer added | Anyone: it is encoded, not encrypted. |
| Signature | A value computed from the first two parts and a key | Only a holder of the right key can check it. |
Because the first two parts are only encoded, never put a secret in a JWT payload. An encrypted token (JWE) has five parts; its payload cannot be read without the key, and this tool then shows only the header.
The Registered Claims
| Claim | Name | Meaning |
|---|---|---|
iss | Issuer | Who created and signed the token. |
sub | Subject | Who the token is about, often a user id. |
aud | Audience | Who the token is meant for. A service should reject a token that is not for it. |
exp | Expiration time | From this moment the token must not be accepted. |
nbf | Not before | Before this moment the token must not be accepted. |
iat | Issued at | When the token was created. |
jti | JWT ID | A unique identifier, useful for revoking one token. |
The three time claims are NumericDate values: seconds since 1 January 1970 UTC. The decoder converts them in your browser with your own clock. If a value is about a thousand times too large, the token probably holds milliseconds, which JWT does not allow, and the tool says so.
Decoding Is Not Verifying
Anyone can write a token whose payload says "admin": true. What makes a real token trustworthy is that a server has checked its signature against a key it trusts, with an algorithm it chose in advance, and then checked the claims that matter: the issuer, the audience and the times. A decoder has done none of that. So “Expired” here means expired by the token's own claim, read against your clock; it is not a ruling on whether a server would accept it, and a token that looks fine here may be forged.
The warnings point at classic mistakes that RFC 8725, the JWT best-practice document, covers: a token with alg set to none has no signature at all, and a header carrying jku, x5u, jwk or x5c names a key supplied by the token itself, which a server must never trust. A token with no exp never expires on its own.
A Worked Example
The example token is signed with HS256, an HMAC with a shared secret. Its payload names the issuer https://auth.example.com, the audience citationeasy-demo and the subject 1234567890, with a list of roles and an admin flag. Both iat and nbf are 1700000000, which is 14 November 2023, 22:13:20 UTC. The exp is 4102444800, which is 1 January 2100 at 00:00 UTC, so the lifetime from iat to exp is about 76 years and the token stays within its time window until 2100. The signature is 32 bytes, the length HS256 produces, so there is no warning.
About the privacy of a decoder
This page makes no request with your token and writes it to no storage. But you cannot see that from the outside, and any page you paste a live token into could in principle send it somewhere. That is why the safest tokens to paste are expired ones, test ones and revoked ones, whichever tool you use. You can also check this page: open your browser's network panel and decode a token.
Frequently Asked Questions
- How do I decode a JWT?
- Split it at the dots, decode the first two parts from base64url, and read them as JSON. Pasting it into this tool does that, shows the header and payload as formatted JSON, explains the registered claims, and turns the time claims into dates. It needs no key, because the header and payload are not encrypted.
- Is it safe to paste my JWT into an online decoder?
- Only if the token is no longer valuable. A live token can be used by whoever holds it, and you cannot always tell what a web page does with what you paste. This decoder sends nothing and stores nothing, but use expired, revoked or test tokens whenever you can.
- Can this tool verify the signature?
- No, by design. Verifying means recomputing the signature with a secret or a public key, which this tool never asks for. It shows the signature's size and warns when that cannot be right for the algorithm, but it cannot say that a signature is genuine.
- What do exp, nbf and iat mean?
expis when the token stops being valid,nbfis when it starts, andiatis when it was issued. Each is a number of seconds since 1 January 1970 UTC. The tool shows them as dates in UTC and in your time zone, and as a time relative to now.- What does alg none mean?
- It says the token has no signature. The specification allows it for tokens whose integrity is guaranteed another way, but a server that accepts it for a token it expects to be signed lets anyone write any claims, so the decoder flags it as a warning.
- Is a JWT encrypted?
- Usually not. A signed token (JWS) is only encoded, so anyone can read it. An encrypted token (JWE) has five dot-separated parts and a payload that needs a key to read. The decoder tells which one it was given and decodes only what it can.
- Why does my token say expired when my server accepts it?
- The decoder compares
expwith your computer's clock. Servers often allow a few seconds or minutes of clock skew, and your clock may be off. A decoder's verdict is a hint about the token's own claims, not the server's decision.