How to decode a JWT
Paste the token into the box. You can include the Bearer prefix copied from an Authorization header; it is stripped automatically. The header and payload are decoded as you type, and the standard claims are translated into plain language, for example "Expires: Tue, 14 Oct 2026 10:00:00 GMT (in 42 minutes)". If the token has already expired, the status bar turns red.
Decoding happens entirely in your browser. That matters more than usual here: a valid access token is effectively a password for as long as it lives, so you should be wary of pasting production tokens into sites that send them to a server.
What's inside a JWT
A JWT is three Base64URL-encoded sections joined by dots: header.payload.signature.
- The header says how the token was signed, for example
{"alg":"RS256","typ":"JWT"}, and sometimes includes akididentifying which key was used. - The payload holds the claims: who the token is about, who issued it, when it expires and any custom data such as roles.
- The signature lets the server confirm nobody has changed the first two parts.
The registered claims
| Claim | Meaning |
|---|---|
iss | Issuer, usually your auth server's URL. |
sub | Subject, typically the user ID. |
aud | Audience: which API the token is meant for. |
exp | Expiry time as a Unix timestamp in seconds. |
nbf | Not valid before this time. |
iat | When the token was issued. |
jti | A unique ID, useful for revocation lists. |
A classic bug is a backend writing exp in milliseconds. The token then appears to expire in the year 58,000 and never times out. The timestamp converter makes that easy to spot.
Decoding is not verifying
This tool does not check the signature, and neither should any client-side code that makes security decisions. Anyone can create a token with any payload; only the server holding the secret or public key can tell whether it is genuine. Use decoding for debugging: "Is the role claim there? Has it expired? Is the audience right?" For more on what belongs in a token, read what's actually inside a JWT.
Frequently asked questions
Is it safe to paste my token here?
The token never leaves your browser; there are no network requests involved in decoding. Still, treat live tokens like passwords and prefer expired or test tokens when you can.
Why does it say the payload might be a JWE?
An encrypted token (JWE) has five parts and an encrypted payload, so it cannot be read without the key. Only signed tokens (JWS) can be decoded this way.
Can this tool verify the signature?
No. Verification requires the secret or public key, and should happen on your server.