JWT Decoder

Read a token's header, claims, and expiry

Not expiredIssued 2026-01-01 00:00:00 UTCExpires 2031-01-01 00:00:00 UTC

Header

{
  "alg": "HS256",
  "typ": "JWT"
}

Payload

{
  "sub": "1234567890",
  "name": "Ann Example",
  "role": "admin",
  "iat": 1767225600,
  "exp": 1924992000
}

Signature

Tq1Qh7s3kz0Jm8cV4yEwXn2pR6fLbA9dGuHiK5oMtZE

Not verified. Decoding only reads the token, so anyone could have edited these claims. Your server must check the signature before trusting them.

JWT Decoder guide

A JSON Web Token (JWT) carries claims about a user or session, such as who they are and when the token expires. The claims are only base64url-encoded, not encrypted, so anyone holding the token can read them. Paste a token here to see its header, payload, and expiry.

The three parts

  • Header. Says how the token was signed, for example alg HS256 or RS256, and often a key ID (kid).
  • Payload. The claims: registered ones like sub, iss, aud, iat, and exp, plus any custom fields the issuer added.
  • Signature. Proves the token was issued by someone holding the signing key and has not been changed. It can only be checked with that key.

Reading the time claims

iat (issued at), nbf (not before), and exp (expires) are Unix timestamps in seconds. The decoder shows them as UTC dates and tells you whether the token has expired or is not valid yet, based on your device's clock.

Decoding is not verifying

This tool reads the token without checking the signature, so a decoded token proves nothing about who issued it. Anyone can change the payload and re-encode it. Your server must verify the signature with the right key, and check exp, before trusting any claim.

Example

The payload part of a token is base64url JSON:

eyJzdWIiOiI0MiIsImV4cCI6MTkyNDk5MjAwMH0

// decodes to

{ "sub": "42", "exp": 1924992000 }

Frequently asked questions

Is it safe to paste my token here?
The token is decoded in your browser and never sent anywhere. Still, a live token works like a password until it expires, so avoid pasting production tokens into any site you do not trust, and prefer expired or test tokens.
Does this verify the signature?
No. It only decodes the header and payload. Verifying needs the secret or public key, and should happen on your server.
Why does it say my token is encrypted?
A token with five parts is a JWE, an encrypted JWT. Its payload cannot be read without the decryption key.
Can I paste the Authorization header value?
Yes. A leading "Bearer " is removed automatically, along with surrounding spaces and line breaks.
Why is my token expired when it should still be valid?
The status uses your device's clock. If the clock is off, or the issuer's clock was, the result can differ by that amount.