JWT Decoder is a free tool that decodes a JSON Web Token (JWT) to show its header and payload. It explains the standard claims, converts timestamps such as exp into readable dates, and tells you whether the token has expired. Decoding happens entirely in your browser: tokens are never sent to our servers.
How to decode a JWT
- Paste the token into the box. A leading
Bearerfrom an Authorization header is removed automatically. - The payload (claims) and header are shown straight away, with an explanation of each standard claim.
- A banner shows whether the token has expired, based on your device’s clock.
What is inside a JWT?
A JWT has three parts separated by dots: header.payload.signature. The header says how the token was signed (for example "alg": "RS256"). The payload holds the claims, facts about the user or session. The signature lets a server check the token hasn’t been altered.
The header and payload are only Base64URL-encoded, not encrypted. That is why anyone can decode them, and why tokens should never contain passwords or other secrets.
Example
A decoded payload might look like this:
{
"sub": "user_8412",
"name": "Jane Doe",
"iat": 1767225600,
"exp": 1767229200
}Here iat (issued at) is 1 January 2026, 00:00 UTC and exp (expires) is one hour later. These are Unix timestamps: seconds since 1 January 1970, UTC.
Standard claims
iss: issuer, the service that created the token.sub: subject, usually the user’s ID.aud: audience, the service the token is meant for.exp: expiry time. After this, the token must be rejected.nbf: not before. The token must be rejected before this time.iat: when the token was issued.jti: a unique ID, often used to revoke individual tokens.
Decoding is not verifying
This tool shows what a token claims. It does not check the signature, so it cannot tell you whether the token is genuine; anyone can create a token with any payload. Your server must verify the signature with the secret (for HS256) or the issuer’s public key (for RS256 and ES256) before trusting any claim.
Troubleshooting
- “A JWT has 3 parts”: part of the token is missing. Copy it again, including everything after the last dot.
- Five parts: this is an encrypted token (JWE). It can only be read with the decryption key.
- Expired, but it still works: servers often allow a little clock skew, or your device’s clock may be wrong.
- Not a JWT at all: some access tokens are opaque random strings that only the issuing server can look up.
JWT parts use Base64URL encoding; to decode other Base64 data, use Base64 Decode.
Frequently asked questions
Is it safe to paste a real token here?
The token is decoded inside your browser and never sent to our servers. Even so, treat live tokens like passwords: anyone who has one can use it until it expires, so avoid sharing them in chats or tickets.
Does decoding verify the token?
No. Anyone can decode a JWT, because the header and payload are only Base64URL-encoded, not encrypted. Only checking the signature with the right secret or public key proves the token is genuine.
What do exp, iat and nbf mean?
They are times in seconds since 1 January 1970 (Unix time). exp is when the token expires, iat is when it was issued, and nbf is the earliest time it may be used. This tool converts them to your local date and time.
Why can’t I decode my token?
Check you copied all three dot-separated parts. Tokens with five parts are encrypted (JWE) and need a key to read. Some access tokens are not JWTs at all, just random strings that only the issuing server understands.
Last updated