How to decode a JWT
- Paste the token into the box. It usually starts with
eyJand has three parts separated by dots. You can paste it with or without theBearerprefix. - The header and payload are decoded instantly and shown as formatted JSON.
- The claims table explains standard fields and converts timestamps such as
expandiatinto readable dates, and tells you whether the token has expired.
What is a JSON Web Token?
A JWT (defined in RFC 7519) is a compact, URL-safe way to pass claims between systems — most often to prove that a user is logged in. After you sign in, the server gives your app a token, and the app sends it with each request in the Authorization: Bearer … header.
A JWT has three Base64URL-encoded parts:
| Part | Contains |
|---|---|
| Header | The signing algorithm (alg, e.g. HS256 or RS256) and token type (typ) |
| Payload | The claims — who the user is, their roles, when the token was issued and when it expires |
| Signature | A cryptographic signature that proves the header and payload haven’t been changed |
Standard claims
| Claim | Name | Meaning |
|---|---|---|
| iss | Issuer | Who created the token |
| sub | Subject | Who the token is about — usually a user ID |
| aud | Audience | Which service the token is meant for |
| exp | Expiration time | Unix timestamp after which the token must be rejected |
| nbf | Not before | Token is not valid before this time |
| iat | Issued at | When the token was created |
| jti | JWT ID | Unique identifier, used to prevent replay |
Decoding is not verifying
Anyone can decode a JWT — the header and payload are only Base64URL-encoded, not encrypted. That is why you should never put secrets such as passwords in a JWT payload. Trust comes from the signature, which only the server can verify with its secret or public key. This tool decodes and inspects tokens; it does not verify signatures, because that requires the key. A decoded token that looks fine may still be forged — your server must always verify it.
Debugging common problems
- 401 Unauthorized after a while: check
exp— the token has probably expired. Times are in UTC seconds. - Token rejected immediately: check
nbfandaud, and that server clocks are in sync. - Missing permissions: look for role or scope claims in the payload.
Frequently asked questions
Is it safe to paste my JWT here?
Yes. The token is decoded in your browser and never sent anywhere. Still, treat live tokens like passwords and avoid sharing them.
Does this tool verify the signature?
No. Verification requires the secret or public key used to sign the token. This tool only decodes and explains the contents.
Why can anyone read my JWT payload?
JWTs are signed, not encrypted. Base64URL encoding is reversible by anyone. Use JWE (encrypted tokens) if the payload must be secret.
How do I know if my token has expired?
Look at the “exp” row in the claims table. It shows the expiry date in your local time and whether it is in the past.