JWT Decoder
Decode a JSON Web Token to read its header and payload, turn exp, iat and nbf into readable dates, and see whether it has expired. Decoding only: the signature is not verified.
- Header and payload decoded
- Readable exp, iat, nbf dates
- Runs locally in your browser
Input
Paste your token
A leading "Bearer " and any spaces or line breaks are removed automatically.
Decoding is done in your browser and the token is never sent anywhere. Still, treat live tokens like passwords and avoid pasting production credentials into any website.
Decoded token
The decoded header, payload and expiry status will appear here.
How to use
How to Decode a JWT
- 1
Paste the token
Copy the JWT from your Authorization header, cookie or API response and paste it in. A leading "Bearer " is stripped for you.
- 2
Read the header and payload
The decoded JSON appears instantly, pretty-printed and ready to copy.
- 3
Check the dates
exp, iat and nbf are shown as local time, UTC (ISO 8601) and relative time, with a live expiry status.
- 4
Verify on your server
Use your JWT library and the real key to verify the signature. This page never does that step for you.
JWT Structure Explained
A signed JWT (JWS compact serialization) is header.payload.signature. The header and payload are JSON objects encoded with base64url, a URL-safe Base64 variant that uses - and _ instead of + and / and drops the = padding.
Base64url is an encoding, not encryption. Anyone who has the token can read the payload, which is why you should never put passwords or other secrets in JWT claims. The signature is computed over header.payload with the algorithm named in alg, for example HS256 (HMAC with SHA-256) or RS256 (RSA with SHA-256).
Registered JWT Claims
RFC 7519 defines these standard claim names. All of them are optional.
| Claim | Name | Meaning |
|---|---|---|
| iss | Issuer | Who created and signed the token. |
| sub | Subject | Who the token is about, usually a user ID. |
| aud | Audience | Which service the token is intended for. |
| exp | Expiration time | Seconds since the Unix epoch after which the token must be rejected. |
| nbf | Not before | The token must not be accepted before this time. |
| iat | Issued at | When the token was created. |
| jti | JWT ID | A unique ID, often used to prevent replay. |
Worked Example: Reading exp
Suppose the payload contains "exp": 1767225600. That is a count of seconds, so multiply by 1,000 to get milliseconds and create a date:
new Date(1767225600 * 1000).toISOString() // "2026-01-01T00:00:00.000Z"
The token is expired once the current time is on or after that moment. If a value is around 13 digits long (for example 1767225600000), it was probably written in milliseconds by mistake, and the decoder warns you.
FAQ
Frequently Asked Questions
What is a JWT?
A JSON Web Token (JWT, RFC 7519) is a compact string made of three base64url-encoded parts separated by dots: a header that names the signing algorithm, a payload of claims such as the user ID and expiry time, and a signature that proves the token was issued by someone holding the key.
Does this tool verify the JWT signature?
No. It only decodes the header and payload so you can read them. The signature is displayed but not checked. Anyone can create a token with any payload, so your server must always verify the signature with the correct secret or public key before trusting a token.
How do I check if a JWT is expired?
Paste the token and look at the time status. The exp claim is a NumericDate, the number of seconds since 1970-01-01 UTC. The tool converts exp, iat and nbf into readable dates and compares exp and nbf with your device clock to show Expired, Not valid yet, or Valid now.
Is it safe to paste my token here?
Decoding happens entirely in your browser and the token is not sent to any server. Even so, a live access token works like a password until it expires, so avoid pasting production tokens into any website you do not control.
Why do I get an error when decoding my token?
The most common causes are a token with fewer or more than three parts, a part that was cut off when copying, characters that are not valid base64url, or a header that is not JSON. Encrypted tokens (JWE) have five parts and cannot be decoded without the key.
Keep going
Related Tools
Hand-picked tools that pair well with this one. All free, no sign-up.
- Developers
JSON Formatter & Validator
Format, validate, and minify JSON with precise error line and column reporting, key sorting, and structure stats.
- Beautify & minify
- Exact error location
- Sort keys
Open tool - Developers
Base64 Encoder / Decoder
Convert text, files, and images to and from Base64 with live previews and MIME detection.
- Text and file modes
- Image preview
- URL-safe option
Open tool - Developers
Hash Generator (MD5, SHA-256)
Generate MD5, SHA-1, SHA-256, SHA-384, and SHA-512 hashes from text or files, and compare hashes instantly.
- MD5 & SHA family
- Text or file input
- Hash compare
Open tool