JWT Decoder

Decode and inspect JWT tokens — header, payload, and signature with smart claim parsing.

DecodeInspectExpiry
JWT TokenHS256
Decoded
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyXzEyMyIsIm5hbWUiOiJKYW5lIERldmVsb3BlciIsImVtYWlsIjoiamFuZUBleGFtcGxlLmNvbSIsInJvbGUiOiJhZG1pbiIsImlhdCI6MTcwOTI1NjAwMCwiZXhwIjoxNzA5MzQyNDAwLCJpc3MiOiJodHRwczovL2F1dGguZXhhbXBsZS5jb20iLCJhdWQiOiJkZXZ0b29sc2xhYiJ9.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

Claims in the payload. Standard claims like exp and iat are parsed with timestamps.

Token valid · expires … — …
subSubject
user_123
nameName
Jane Developer
emailEmail
jane@example.com
roleRole
admin
iatIssued At
…✓ valid · …
expExpires At
…✓ valid · …
issIssuer
https://auth.example.com
audAudience
devtoolslab

All decoding happens locally in your browser — your tokens never leave your device.

A JSON Web Token (JWT) is a compact string of three Base64URL-encoded parts separated by dots: a header that names the signing algorithm, a payload of claims about the user or session, and a signature. This decoder splits a signed JWT, decodes the header and payload, and explains the claims so you can see who a token was issued to, by whom, and whether it has expired.

The Payload tab lists each claim on its own row. Registered claims (sub, iss, aud, exp, iat, nbf, jti) and common ones (name, email, role, roles) are labelled with their meaning, and the time claims exp, iat and nbf are converted from Unix seconds into a readable local date with a relative time such as "3h ago". If the token has an exp claim, a banner states whether it is still valid or already expired according to your device clock.

Decoding is not verification. Anyone can read a JWT payload because it is only encoded, not encrypted, and this tool does not check the signature, so a decoded token may still be forged or tampered with. If you only need the raw header and payload JSON side by side for copying, the JWT Parser is the simpler view.

  1. Paste the token into the JWT Token box (without a "Bearer " prefix). A sample token is preloaded.
  2. Check the colour-coded breakdown under the input: header, payload and signature segments, plus the algorithm badge (for example HS256 or RS256).
  3. Open the Payload tab to read each claim with its meaning and to see the expiry banner if the token has an exp claim.
  4. Use the Header tab for fields such as alg, typ and kid, the Signature tab to copy the Base64URL signature, and the Raw JSON tab to copy the decoded header or payload as formatted JSON.
  5. Click Clear when you are done, especially if you pasted a live production token.

  • Decodes the header and payload of signed (JWS) tokens as you type
  • Labels registered and common claims: sub, iss, aud, exp, iat, nbf, jti, name, email, role, roles
  • Converts exp, iat and nbf to local date and relative time
  • Expiry banner showing whether the token is expired based on the exp claim
  • Colour-coded token segments and a signing-algorithm badge
  • Raw JSON tab with copyable, formatted header and payload
  • Decoding happens in your browser; the token is not sent to a server

Token structure

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9   <- header (Base64URL)
.
eyJzdWIiOiJ1c2VyXzEyMyIsImV4cCI6MTcwOTM0MjQwMH0   <- payload (Base64URL)
.
SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c   <- signature

The three parts are joined with dots. Only the first two contain JSON; the signature is binary data encoded as Base64URL.

Decoded header

{
  "alg": "HS256",
  "typ": "JWT"
}

alg is the signing algorithm the issuer used. HS* algorithms use a shared secret; RS*, PS* and ES* use a public/private key pair.

Payload claims as shown in the Payload tab

sub   Subject      user_123
iss   Issuer       https://auth.example.com
aud   Audience     devtoolslab
iat   Issued At    2024-03-01 01:20 UTC (shown in local time)
exp   Expires At   2024-03-02 01:20 UTC (shown in local time)  x expired

Banner: Token expired ... ago

exp 1709342400 and iat 1709256000 are Unix timestamps in seconds; the decoder shows them as dates and flags the token as expired.

Invalid JWT - must have 3 parts separated by dots

The input is incomplete, or is not a signed JWT at all (for example an opaque access token, or a five-part JWE).

Copy the full token value; a signed JWT contains exactly two dots. Opaque tokens cannot be decoded and must be checked with the issuer, for example via token introspection.

Failed to decode - make sure this is a valid JWT token

The header or payload segment is not valid Base64URL, or decodes to something that is not JSON, usually because characters were lost or altered when copying.

Remove any "Bearer " prefix, surrounding quotes and line breaks, or copy the token again from its source (cookie, Authorization header, local storage). To inspect a single segment by hand, try the Base64 decoder.

Token shows as expired

The exp claim is earlier than the current time on your device. Access tokens are often short-lived (minutes to an hour).

Obtain a new token via your refresh flow or log in again, and check your system clock if the result seems wrong.

Does this tool verify the JWT signature?

No. It only decodes the header and payload. Verification needs the issuer's secret (HS256) or public key (RS256, ES256) and must be done by your server or auth library, which should also check exp, nbf, iss and aud. Never paste a signing secret into a web page.

Is it safe to paste a real token here?

The token is decoded in your browser with JavaScript and is not uploaded. Still, a valid access token works like a password until it expires, so avoid sharing screenshots of it and prefer expired or test tokens when possible.

What do exp, iat and nbf mean?

They are NumericDate claims: seconds since 1970-01-01 UTC. exp is when the token stops being valid, iat is when it was issued, and nbf is the earliest time it may be accepted. Note that JavaScript Date.now() is in milliseconds, so compare exp against Date.now() / 1000. The Timestamp Converter is useful for checking values by hand.

Why does the decoder say my token is expired when the server accepts it?

The status is computed from your device clock. If your clock is wrong, or the server allows a clock-skew leeway, the result can differ. The decoder also does not evaluate nbf or any server-side revocation.

JWT Decoder or JWT Parser: which should I use?

Use this decoder when you want claim meanings, readable dates and an expiry check. Use the JWT Parser when you just want the header and payload as raw JSON in two panes to copy into code or a ticket.

Can it decode encrypted tokens (JWE)?

No. Encrypted JWE tokens have five dot-separated parts and an encrypted payload that cannot be read without the key. This tool accepts only three-part signed tokens.