JWT Decoder

Decode the header and payload of a JWT (JSON Web Token) instantly, with readable expiry and issue dates. The token never leaves your browser.

Header
Payload

  

  

    
    
  

  

  
The signature is not verified. Decoding only shows what the token contains; checking that it is genuine requires the secret or public key, which belongs on your server.






  
How to decode a JWT

  
    
    
  1. Paste the token into the box. A leading Bearer  from an Authorization header is removed automatically.
    2. 
    
  2. The header and payload are decoded and shown as formatted JSON.
    3. 
    
  3. Times such as exp (expiry) and iat (issued at) are converted to readable dates, and you can see at a glance whether the token has expired.
    4. 
  


  
What is a JSON Web Token?

  
A JWT is a compact token used for logins and API access. It has three parts separated by dots: a header that names the signing algorithm, a payload with claims about the user or session, and a signature. The header and payload are only Base64url-encoded, not encrypted, so anyone holding the token can read them.


  
Standard claims

  
    
    
  • iss – who issued the token
    • 
    
  • sub – who the token is about, usually a user ID
    • 
    
  • aud – who the token is intended for
    • 
    
  • exp, nbf, iat – expiry time, not-valid-before time and issue time, as Unix timestamps (see the Unix Timestamp Converter)
    • 
  


  
FAQ

  
Is it safe to paste my token here?

  
The token is decoded in your browser and never sent anywhere. Still, a valid token works like a password until it expires, so avoid sharing real production tokens with anyone.

  
Should I put secrets in a JWT?

  
No. The payload is readable by anyone who has the token. Put only identifiers and permissions in it, never passwords or personal data you would not want exposed.