JWT Decoder

See what a token says before you trust it

A JSON Web Token (JWT) carries claims, such as who a user is and when their login runs out, between a sign-in service and an app. It looks like a jumble because each part is base64url-encoded, not because it’s secret. This tool turns it back into readable JSON, which helps when a login fails, a session ends too soon or an API refuses a request.

How to use it

1. Copy a token from your app, an Authorization header or your browser’s developer tools.
2. Paste it into the box. It’s decoded as you paste.
3. Read the summary first: signed or not, and expired or not by your device’s clock.
4. Check the claims, then copy the header or payload, or download both as one JSON file.

The three parts

• Header: the token type and the signing algorithm, such as HS256 or RS256.
• Payload: the claims. Seven are standard (iss, sub, aud, exp, nbf, iat and jti); anything else is up to the issuer.
• Signature: made from the first two parts with the issuer’s key. It’s shown as written, never checked.

Reading the result

The line at the top says whether the token is signed and whether it has expired. Each time claim is shown in your time zone and in UTC, with how long ago or how soon it falls. Notes flag anything unusual: a token without a signature, a claim named twice, a signature of the wrong length, or a time that looks like milliseconds.

What it doesn’t do

It doesn’t verify signatures, so it can’t tell a genuine token from a forged one: verifying needs the issuer’s key, and belongs on your server. It can’t decrypt an encrypted token (JWE), and it doesn’t make or edit tokens.

Good practice

• Treat live tokens like passwords. Anyone holding one can act as you until it expires. Prefer test or expired tokens when debugging.
• Payloads aren’t private. Anyone with the token can read them, so they shouldn’t hold secrets.
• Refuse “alg”: “none”. A token without a signature proves nothing.

Good to know

Times in a JWT are seconds since January 1, 1970 (UTC). Expiry is judged by your device’s clock, which can differ from your server’s by a few minutes. Large numbers are shown exactly as written. To check meeting times across places, use the Time Zone Converter.