JWT Decoder

Paste a JSON Web Token to see its header, payload and issue and expiration dates. Decoding happens in your browser, so the token is never sent to a server.

JWT token

Header

{
  "alg": "HS256",
  "typ": "JWT"
}

Payload

{
  "sub": "1234567890",
  "name": "Jane Doe",
  "role": "admin",
  "iat": 1735689600,
  "exp": 4102444800
}

Token dates (UTC)

Issued at (iat): January 1, 2025 at 12:00:00 AM
Expires at (exp): January 1, 2100 at 12:00:00 AM

Signature

SVeJGvSn3pRA6BHtJk8jiig6THFcFEHKvL1a_u2b5Tc

The signature is not verified. That requires the issuer's secret or public key.

What is a JWT?

A JWT (JSON Web Token) is a standard (RFC 7519) for passing signed information between systems. It is widely used for login and API authentication: after the user signs in, the server returns a token that the app sends in the Authorization: Bearer header of every request.

The three parts of a JWT

Header: the token type and signing algorithm, such as HS256 or RS256.
Payload: the claims, such as the user ID (sub), issue time (iat) and expiration (exp).
Signature: proves that the header and payload were not tampered with.

The header and payload are just Base64URL-encoded JSON, so anyone can read them.

How to decode a JWT

Copy the token, with or without the Bearer prefix.
Paste it above. The header and payload appear formatted.
Check the issue and expiration dates converted from Unix timestamps.

Security: never put passwords or sensitive data in a JWT payload, because it is not encrypted. And avoid pasting production tokens into sites that send them to a server. Everything here runs locally.

Frequently asked questions

Is it safe to paste my JWT here?

Yes. Decoding happens in your browser and the token never leaves your device. Still, avoid sharing valid production tokens anywhere.

Does decoding a JWT verify its signature?

No. Decoding only reads the header and payload. Verifying the signature requires the issuer's secret (HS256) or public key (RS256).

How do I know if a JWT has expired?

Check the exp claim in the payload. It is a Unix timestamp in seconds, and the tool shows it as a date and tells you whether the token has expired.

Is a JWT encrypted?

Usually not. A standard JWT (JWS) is only signed, so anyone can read its contents. Encrypted JWTs (JWE) exist but are much less common.

What do iat, exp and sub mean?

iat is the issue time, exp is the expiration time and sub is the subject, usually the user ID.