How to use the jwt decoder
- Paste your token. It looks like three Base64 parts separated by dots.
- The header and payload appear as formatted JSON.
- If the token has an exp claim, you will see whether it has expired.
About this tool
A JSON Web Token has three Base64URL parts: header, payload and signature. This decoder splits the token, shows the header and claims as formatted JSON, and tells you whether the exp claim has passed. It does not verify the signature, which needs your secret or public key.
What is inside a JWT
A JSON Web Token is three Base64URL-encoded parts separated by dots: header.payload.signature. The header says which algorithm signed the token. The payload holds claims, which are statements about the user and the token. The signature lets the server check the first two parts were not changed.
Common claims
| Claim | Meaning |
|---|---|
| iss | Issuer: who created the token |
| sub | Subject: usually the user ID |
| aud | Audience: who the token is meant for |
| exp | Expiry time, as a Unix timestamp in seconds |
| nbf | Not before: the token is invalid until this time |
| iat | Issued at: when the token was created |
| jti | A unique token ID |
Decoding is not verifying
Anyone can read a JWT payload, because Base64URL is an encoding, not encryption. Never put passwords or secrets in a token. Reading the claims here tells you what the token says, but it does not prove the token is genuine. Only a server holding the signing key, or the matching public key, can verify the signature. Never trust the claims of an unverified token for access decisions.
Why a token will not decode
- The token still has the "Bearer " prefix from the Authorization header. Remove it.
- It has been cut off when copied, so a part is missing.
- It has five parts instead of three. That is an encrypted token (JWE), which cannot be read without the key.
- Extra spaces or line breaks were added when pasting.
Reading the expiry
The exp claim is a Unix timestamp in seconds, for example 1760000000. This tool converts it to your local time and tells you whether it has passed. If a token that should be valid is shown as expired, check the clock on your server and device, because small differences cause confusing errors.
Frequently asked questions
Is it safe to paste a real token here?
Decoding happens in your browser and nothing is sent anywhere. Still, treat live production tokens carefully and avoid sharing them.
Does this verify the signature?
No. It only decodes the token. Verifying a signature needs the secret or public key.
What is exp?
exp is the expiry time as a Unix timestamp in seconds. This tool converts it to your local time.
Is it safe to paste a production token here?
Decoding happens in your browser and nothing is sent anywhere. Still, a live token grants access to whoever holds it, so avoid pasting tokens into any tool on a shared or untrusted device.
What does alg none mean?
It means the token claims to have no signature. A well-configured server must reject such tokens, so treat one you did not expect as a red flag.