JWT Decoder

Paste a JWT to read its header and payload, understand every claim in plain English and see at a glance whether it is still valid. The signature is not verified, and the token never leaves your browser.

🔒 Your data never leaves your device🆓 Free🙅 No sign-up
🚫 The signature is NOT verified — This tool decodes a token; it cannot tell you whether the token is genuine. Verifying a signature needs the issuer’s secret or public key, and a tool that asked you for your signing key would be a tool you should not use. Treat everything below as claims the token makes about itself, not as facts.

header.payload.signature — a “Bearer ” prefix is fine, it is stripped automatically.

🔒 The token is decoded by JavaScript inside your browser tab. It is never sent to a server, never logged and never stored — which matters, because a live access token in someone else’s log file is a security incident.

How to use the JWT decoder

  1. Paste the token into the box. A leading Bearer is stripped automatically, so you can copy straight from an Authorization header.
  2. Read the validity banner at the top: ✅ inside its window, ⚠️ not yet valid, or ❌ expired, with the exact time and a relative phrase such as “expired 2 hours ago”.
  3. Scan the claims table, which explains every registered claim in plain English and converts every timestamp to a readable UTC time.
  4. Copy the header or payload JSON with one click if you need it in a bug report or a test fixture.
  5. If the token is malformed, read the error — it names the segment and the reason rather than just saying “invalid”.

What a JWT actually is

A JSON Web Token is three Base64url strings joined by dots: header.payload.signature.

Segment Contains Readable?
Header the algorithm alg, the type typ, often a key id kid ✅ yes
Payload the claims: who, what, and for how long ✅ yes
Signature raw bytes proving the first two were not altered ❌ binary

Base64url is encoding, not encryption. Anyone holding the token can read the payload — including in a browser console, a proxy log or a screenshot. That is by design: a JWT is meant to be readable by the parties handling it, and the signature is what stops it being modified. Never put a password, a card number or anything else confidential into a payload.

The registered claims from RFC 7519 are iss (issuer), sub (subject), aud (audience), exp (expires at), nbf (not before), iat (issued at) and jti (token id). Everything else is either a public claim from a registry such as OpenID Connect, or a private claim your own system invented.

Worked examples

The RFC example token. eyJ0eXAiOiJKV1QiLA0KICJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQogImh0dHA6Ly9leGFtcGxlLmNvbS9pc19yb290Ijp0cnVlfQ.dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk is the token printed in RFC 7519 itself. It decodes to an HS256 header and a payload issued by joe with exp 1300819380 — 22 March 2011. The banner shows ❌ expired, because it genuinely is, by well over a decade.

Reading an expiry. A token with iat 1789981200 and exp 1830297600 was issued on 21 September 2026 and lasts until 1 January 2028 — a lifetime of about 466 days. Access tokens that live that long are a red flag: if one leaks, it stays useful for over a year. Minutes to hours is the normal range, with a refresh token handling the rest.

Not yet valid. If nbf is five minutes in the future, every check fails until that moment arrives. This almost always means the issuing server’s clock is ahead of the verifying server’s, not that anything was issued deliberately in the future.

A broken token. Paste eyJhbGciOiJIUzI1NiJ9.aGVsbG8.sig and the tool reports that the payload segment decoded fine but is not valid JSON — it decodes to the word hello. That is a far more useful message than “invalid token”.

Tips and common mistakes

  • Decoding is not verifying. A decoded payload tells you what the token claims. Only signature verification on the server tells you whether to believe it.
  • Check aud as well as exp. A token issued for one service is not valid for another, even inside the same company.
  • Pin the algorithm server-side. Accept only the algorithm you expect. Trusting the header’s alg is how none attacks and RSA-to-HMAC confusion attacks succeed.
  • Keep lifetimes short. Minutes for an access token, with refresh handled separately. You cannot un-issue a JWT once it is out there.
  • exp is in seconds. Multiplying by 1000 twice is the single most common JWT bug.
  • Do not store tokens in localStorage if you can avoid it. Any script on the page can read it; an HttpOnly cookie cannot be read by script at all.

Glossary

  • Claim – one key/value pair in the payload.
  • NumericDate – seconds since 1 January 1970 UTC, the format used by exp, nbf and iat.
  • Base64url – Base64 with - and _ instead of + and /, and no padding.
  • kid – key id in the header, telling the verifier which of the issuer’s keys to use.
  • JWE – a five-segment encrypted token; its payload cannot be read without the decryption key.

Privacy

Your token is decoded by JavaScript running inside your browser tab. There is no request to a server, no analytics event carrying the value, nothing written to local storage or a cookie, and no logging of any kind — closing the tab discards it completely. This is not a detail to gloss over: a JWT pasted into an online decoder is a live credential handed to a third party, and several well-known debugging sites do round-trip tokens through their backend. Here the only copy is the one in your clipboard.

Frequently asked questions

Does this tool verify the signature?

No, and it is important that it does not. Verifying needs the issuer's HMAC secret or public key, and any site asking you to paste a signing secret is a site you should walk away from. This tool reads what the token says about itself; whether the token is genuine is a question only the issuer's key can answer.

Is it safe to paste a real access token here?

Decoding happens entirely in your browser with no network request, so nothing is transmitted or logged. That said, a live token is a live credential — if you are debugging a production incident, prefer an expired or test token, and rotate anything you are unsure about.

What does "alg none" mean and why is it dangerous?

It marks an unsecured JWT with no signature at all. The danger is server-side: a library that honours the header's algorithm will happily accept a token an attacker edited, because there is nothing to check. Servers must pin the expected algorithm rather than trust the header.

Why is the expiry time an odd-looking number?

The exp, nbf and iat claims use NumericDate — seconds, not milliseconds, since 1 January 1970 UTC. A value like 1789981200 is a Monday in September 2026. Passing milliseconds by mistake produces a token that expires in the year 58000, which this tool points out.

The token looks valid here but my API rejects it. Why?

The dates are only one of several checks. The server also verifies the signature, that the issuer matches, that the audience contains its own identifier, and often that the token has not been revoked. Clock skew between machines is another common cause, which is why most libraries allow a small leeway.

Can I edit a payload and re-sign it here?

No. Re-signing requires the secret key, and this tool deliberately never handles keys. Use your backend library or a command-line tool for that, where the key stays on a machine you control.

Related tools

Last reviewed: