JWT decoder
Decode a JSON Web Token to read its header, payload and expiry time. Decode only, in your browser. Do not paste real secrets.
Runs in your browser. Nothing you enter is uploaded.
What it does
A JSON Web Token (JWT) has three parts separated by dots: a header, a payload and a signature. The first two are only Base64URL-encoded JSON, so anyone can read them. This tool shows them, and turns the time claims into readable dates.
How to use it
- Paste a test token.
- Read the header and payload as formatted JSON.
- Check the issued-at, not-before and expiry times, shown in UTC.
Worked example
A token whose first part is eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9 has the header {"alg":"HS256","typ":"JWT"}.
How it works
Each of the first two parts is decoded from Base64URL to UTF-8 text and parsed as JSON. The claims iat, nbf and exp are Unix timestamps in seconds. The signature is not verified: that needs the secret or public key, and should be done by your server.
Questions
Is a JWT encrypted?
Usually not. A normal signed JWT can be read by anyone who has it. Never put passwords or private data in the payload.
Does this tool tell me whether a token is valid?
No. It only decodes. A decoded token can still be forged or expired; only signature verification on the server proves it is genuine.
Why should I not paste real tokens into websites?
Whoever holds a valid token can act as the user until it expires. This page does not send it anywhere, but you cannot check that for every site, so keep the habit.
Why does decoding fail?
The text does not have three dot-separated parts, or a part is not valid Base64URL-encoded JSON.
Related tools
Need an app or website for your shop? See how to hire us →