JWT Decoder

Splits a JSON Web Token into its header and payload and shows both as formatted JSON, plus a human-readable expiry check when the token carries an exp claim. This runs entirely in your browser, and for a JWT that is not a nicety - a live token pasted into a server-side decoder is a leaked credential. One honest limit: this tool decodes, it does not verify. Checking the signature requires the signing key, which your browser does not have and this site would never ask for.

How to use the JWT decoder

1. Copy the token only. If it came from an Authorization header, leave out the word Bearer and the space after it. If it came from JSON, leave out the surrounding quotes.
2. Paste it into the Token in box. Spaces or line breaks before and after the token are ignored.
3. Click Decode.
4. Read the Decoded out box from top to bottom: a HEADER section, a PAYLOAD section, an EXPIRY section if the payload has an exp claim, and a closing line reminding you the signature was not checked.
5. Use Copy result to copy the decoded text, and Clear to remove the token from the page when you are done.

What is inside a JWT

A signed JWT uses the compact format from RFC 7515: three Base64url strings joined by dots.

1. Header. A small JSON object describing the token. alg names the signing algorithm, such as HS256 (an HMAC with a shared secret) or RS256 (an RSA signature checked with a public key). typ is usually JWT, and kid, when present, tells the server which key to use.
2. Payload. A JSON object of claims. Anything can go here, but a few names are registered: iss (issuer), sub (subject, usually a user ID), aud (intended audience), exp (expiry), nbf (not valid before), iat (issued at), and jti (a unique token ID). The three time claims are NumericDate values: whole seconds since 1970-01-01 UTC.
3. Signature. Bytes computed over the text header.payload using the algorithm and key. Change one character of either part and the signature no longer matches.

Base64url is Base64 with - and _ in place of + and /, and with the = padding removed. The decoder converts each part back to standard Base64, restores the padding, reads the bytes as UTF-8, and parses the JSON. Nothing about this is secret: anyone holding a token can read its payload, which is why tokens should never carry passwords or other sensitive data.

A worked example

Paste this token:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkFkYSBMb3ZlbGFjZSIsInJvbGUiOiJhZG1pbiIsImlhdCI6MTc2NzIyNTYwMCwiZXhwIjoxNzY3MjI5MjAwfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

Click Decode and the output is:

HEADER
{
  "alg": "HS256",
  "typ": "JWT"
}

PAYLOAD
{
  "sub": "1234567890",
  "name": "Ada Lovelace",
  "role": "admin",
  "iat": 1767225600,
  "exp": 1767229200
}

EXPIRY
2026-01-01T01:00:00.000Z  (EXPIRED 372193 min ago)

Signature present but NOT verified - verification requires the signing key.

The minute count in the EXPIRY line depends on when you click, so yours will be larger. The token was issued at midnight UTC on January 1, 2026 (iat) and expired one hour later (exp is exactly 3,600 seconds after iat). The iat value is shown as a raw number; only exp gets converted to a date. The count is rounded to whole minutes and uses your computer's clock.

Common problems and how to fix them

"A JWT has three dot-separated parts; this has 5."

Five parts means an encrypted token (JWE). Its payload is ciphertext, and only a holder of the decryption key can read it. One part usually means the token is not a JWT at all. Many services issue opaque random tokens that carry no readable data.

"Header is not valid Base64URL-encoded JSON."

Almost always, extra text was copied along with the token: Bearer at the front, quotes around it, or a cookie name such as session=. Delete everything before the first eyJ. Nearly every JWT starts with those three characters, because {" encodes to eyJ. If the payload error appears instead, the middle part was probably cut off during copying.

The expiry date is tens of thousands of years away

The token's issuer wrote exp in milliseconds instead of seconds. The decoder multiplies by 1,000 as the standard requires, so a 13-digit value lands far in the future. The claim is nonstandard, and libraries that follow RFC 7519 will treat the token as valid for that long. Report it to whoever issues the token.

There is no EXPIRY section

The payload has no exp claim, or its value is 0. A token without an expiry stays valid until the server rejects it for another reason, which is worth knowing when you review how tokens are issued.

The token says "valid" but the server rejects it

The decoder only looks at exp. It does not check nbf, aud, or iss, and it cannot check the signature. A server may also allow for clock differences or revoke tokens early. Compare those claims with what the server expects. The final line appears for every token, even an unsigned one with "alg": "none" and an empty third part, so check the header's alg yourself.

Related tasks

To turn iat or nbf into a readable date, paste the number into the Unix timestamp converter. To look at a single Base64 segment on its own, use the Base64 decoder after swapping - for + and _ for /.

Questions this tool gets asked

Is it safe to paste a real token here?

The token is processed by JavaScript in this tab and never transmitted. That said, treat live production tokens like passwords anywhere: decode expired or test tokens when you can.

Why doesn't this verify the signature?

Signature verification requires the secret or public key the token was signed with. A decoder without your key can only inspect contents; any online tool claiming to 'verify' without a key is only checking the format.

What does the expiry line mean?

If the payload has an exp claim (a Unix timestamp), the tool converts it to a date and says whether the token is still valid or how long ago it expired.

Related tools

• base64 ⇄ textBase64 both directions, UTF-8 safe, emoji included.
• url ⇄ textPercent-encoding both ways, component or whole-URL mode.
• html ⇄ entitiesEscape text for HTML, or decode entities back to text.