JWT Decoder
Paste a token and read what it says, including when it expires.
The answer appears here as you type.
Guide: Three parts, two of them readable3 min read
Three parts, two of them readable
A JWT is three base64url chunks joined by dots. The first is the header, which says how the token was signed (HS256, RS256…). The second is the payload of claims: who the user is (sub), who issued it (iss), who it is for (aud), when it expires (exp). The third is the signature. The first two are encoded, not encrypted — paste a token and this page shows all of it, formatted.
Expiry in plain words
A JWT's dates are seconds since 1970, which nobody reads at a glance. The page turns exp, iat and nbf into dates and says whether the token has expired, how long ago, or how long it has left. It is the first thing to check when an API suddenly starts answering 401.
Why the signature is not verified
Verifying needs the secret (HS256) or the public key (RS256), and pasting a signing secret into a web page is exactly the mistake that exposes a system. So this tool only reads. Verification belongs on your server, with your language's library. A token with alg none — no signature at all — is flagged: no server should accept one.
Nothing is sent
The token is decoded in this tab and goes nowhere, and the page works offline. Still, a live access token is a credential: prefer pasting test or expired tokens. To read a loose base64 string, use the Base64 encoder; to format a large JSON document, the JSON formatter.
Frequently asked questions
Is it safe to paste a token here?
Nothing leaves this tab — the token is decoded by code running in your browser. Still, treat a live access token like a password: anyone holding it can use it until it expires. Prefer tokens from a test environment, or ones that have already expired.
Does it verify the signature?
No, on purpose. Verifying needs the signing secret or the public key, and a web page asking you to paste a signing secret is exactly what you should never trust. This tool reads the token; your server is the one that must verify it.
Is the payload of a JWT encrypted?
No. A normal JWT (JWS) is only base64url-encoded, so anyone with the token can read every claim — which is what this page shows. Never put passwords or personal data in a JWT payload. Encrypted tokens (JWE) have five parts and cannot be read without the key.
What do exp, iat and nbf mean?
They are Unix timestamps in seconds: exp is when the token stops being valid, iat when it was issued, nbf the moment before which it must be rejected. The page turns them into dates and says how long ago it expired or how long it has left.
Why is alg none flagged?
A token with alg none has no signature, so anyone could have written it. Some old libraries accepted such tokens as valid, which let attackers forge any identity. A server should always reject them.