Developer Tools
JWT Decoder
Decode a JSON Web Token to inspect its header and claims. Timestamps such as exp, iat and nbf are converted to readable dates, and the token is checked for expiry. Your token never leaves your browser.
Decode a JWT
Paste a token, with or without the "Bearer " prefix. Decoding updates as you type.
How to Decode a JWT
- Copy the token from your browser's developer tools, an
Authorization: Bearerheader, a cookie or your application logs. - Paste it into the box. The "Bearer " prefix and line breaks are removed automatically.
- Read the decoded header and payload, the table of claims with readable dates, and the expiry status at the top.
Press Load Example Token to see how a decoded token looks.
What Is a JSON Web Token?
A JSON Web Token (JWT, pronounced "jot") is a compact, signed way of passing information between systems, most often used for login sessions and API authorisation. Identity providers such as Auth0, Firebase, AWS Cognito, Keycloak, Microsoft Entra ID and Google issue JWTs.
A JWT has three parts separated by dots:
- Header – the token type and signing algorithm, for example
{"alg": "HS256", "typ": "JWT"}. - Payload – the claims: statements about the user and the token, such as their ID, roles and expiry time.
- Signature – created from the header and payload with a secret or private key, so the server can detect if the token was changed.
The header and payload are only Base64URL-encoded, not encrypted, which is why they can be decoded without any key.
Standard JWT Claims
| Claim | Meaning |
|---|---|
iss | Issuer – who created the token |
sub | Subject – usually the user ID |
aud | Audience – which application or API the token is meant for |
exp | Expiration time, as a Unix timestamp in seconds |
nbf | Not before – the token must not be accepted before this time |
iat | Issued at – when the token was created |
jti | JWT ID – a unique identifier, used to prevent reuse |
Debugging Common JWT Problems
- 401 Unauthorized after a while: check the
expclaim. Access tokens often expire after 5 to 60 minutes and must be renewed with a refresh token. - Token rejected immediately: compare
audandisswith what your API expects, and check that the server clock is correct, becausenbfandiatin the future cause rejections. - Missing permissions: look at the
scope,rolesorpermissionsclaims to see what the token actually grants. - "Invalid signature": the token was signed with a different key, or the
algdoes not match the server configuration. Signatures must be verified on the server with the correct key.
Security Notes
- Decoding is not verifying. This tool shows what a token says, but it does not check the signature. Your server must always verify the signature with the correct key before trusting any claim.
- Never put secrets in a JWT payload. Anyone who has the token can read it.
- Treat tokens like passwords. A valid token gives access to an account until it expires. Avoid pasting live production tokens into websites that send data to a server. This decoder works entirely in your browser.
- Reject
alg: none. Unsigned tokens must never be accepted by a server. The decoder warns you if it sees one.
Frequently Asked Questions
Can I decode a JWT without the secret key?
Yes. The header and payload are only Base64URL-encoded, so anyone can read them. The secret or public key is needed only to verify the signature.
Does this tool verify the JWT signature?
No. It decodes and inspects the token. Signature verification must happen on your server with the correct secret or public key.
How do I check if a JWT has expired?
Paste the token. The decoder reads the exp claim, shows it as a readable date and tells you whether the token has expired and how long ago or how long remains.
Is it safe to paste my token here?
The token is decoded entirely in your browser and is not uploaded or stored. Even so, treat live tokens like passwords and avoid sharing them.
What do exp, iat and nbf mean?
They are Unix timestamps in seconds: exp is when the token expires, iat is when it was issued, and nbf is the earliest time it can be used. The decoder converts all of them to readable dates.
Why does my token have five parts instead of three?
Five parts means it is an encrypted JWT (JWE). Its payload cannot be read without the decryption key.