JWT Decoder
Decode a JSON Web Token and read its header, claims and expiry
About this tool
A JSON Web Token is three base64url segments joined by dots: a header describing the signing algorithm, a payload of claims, and a signature. The first two segments are not encrypted — anyone holding the token can read them — so decoding one is the fastest way to see what an API actually issued.
Paste a token and this tool splits it, decodes the header and payload, and renders the registered time claims (exp, iat, nbf) as readable dates alongside a live expired / valid verdict. Nothing is uploaded and the signature is never checked, because verifying it would require your signing key.
When to use it
- Working out why an API keeps answering 401 when the token looks fine
- Checking whether an access token has expired, and exactly when it did
- Reading the scopes, roles or tenant a token was issued for
- Confirming which algorithm and key id (kid) an identity provider signed with
Worked example
Input
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5cOutput
Header
{
"alg": "HS256",
"typ": "JWT"
}
Payload
{
"sub": "1234567890",
"name": "John Doe",
"iat": 1516239022
}iat 1516239022 is rendered as 18 January 2018, 01:30:22 UTC. This token carries no exp claim, so it never expires on its own.
Frequently asked questions
Does this tool verify the JWT signature?
No. Verifying a signature needs the issuer's secret or public key, and pasting a signing key into a web page is exactly what you should not do. This tool decodes the header and payload only — treat a decoded token as unverified input.
Is it safe to paste a token here?
Decoding happens entirely in your browser and nothing is sent to a server. Even so, a JWT is a credential until it expires, so prefer a test token and revoke anything you have shared elsewhere.
Why can I read the payload without a key?
A signed JWT is base64url-encoded, not encrypted. The signature proves the token was not tampered with; it does not hide the claims. Never put a secret in a JWT payload.