JWT Decoder
Paste a JSON Web Token (JWT) and instantly view its header and payload as readable JSON. It also shows whether the token has expired, how much life it has left, and its signature.
JWT token
The token is decoded in your browser: it's never sent to any server. Header and payload are shown as JSON along with the expiration status (exp).
Decoded content
How to use: Decode JWT
- 1Paste the JWT.
- 2Read the decoded header, payload and signature.
- 3Check the expiration date and whether the token is still valid.
What is it for?
- Debug authentication issues in APIs.
- Check which claims and permissions a token carries.
- Find out when a session expires.
Understanding a JWT from the inside
Structure of a token
A JSON Web Token is three URL-safe Base64 parts separated by dots: header (algorithm and type), payload (the claims) and signature. Decoding the first two needs no key because they are only encoded, not encrypted: anyone who holds the token can read its contents.
Common claims
iss identifies the issuer, sub the subject (usually the user), aud the intended audience, exp the expiry time, nbf the moment from which it is valid and iat when it was issued. exp, nbf and iat are seconds since 1970 (Unix timestamp); this tool converts them to readable dates and tells you whether the token has expired.
Decoding is not verifying
Seeing the contents does not prove the token is genuine. Validity depends on checking the signature with the right key on your server, plus validating exp, iss and aud. Never trust data from a JWT without verifying it, and beware of tokens with alg: none or confusion between symmetric and asymmetric algorithms.
What not to put in a JWT
Because the payload is readable, avoid including passwords, sensitive personal data or internal information. Keep access tokens short-lived and use refresh tokens to renew them. The token is decoded in your browser and is not sent anywhere.
Related tools
Related articles
Frequently asked questions
Is the token sent to a server?+
No. The whole process happens in your browser. The token is decoded locally with no external connections.