Home › Generators & Text Tools › JWT Decoder Online
JWT Decoder Online
Paste a JSON Web Token (JWT) below and read what is inside it: the header, the payload claims, and the expiry and issued-at times as plain dates. Everything is decoded in your browser — nothing is uploaded anywhere.
Header
Payload
Tip: the signature is the third part of the token. This page shows it exists, but it cannot check whether it is valid.
How it works
A JWT is one long string made of three parts, separated by dots. The first part is the header, the second is the payload, and the third is the signature. The header and the payload are each JSON text encoded with base64url — a variant of base64 that is safe to use in web addresses. Decoding simply reverses that encoding and shows the JSON underneath. That is all this tool does, and it happens entirely in your browser.
The header is small. It usually says which signing algorithm was used, such as HS256, and that the token type is JWT. The payload is where the useful information lives. It holds claims — named pieces of data such as sub (the subject, usually a user id), name, and role. Three claims are about time, and all three are stored as Unix timestamps, which count the seconds since 1 January 1970. The iat claim is when the token was issued, exp is when it expires, and nbf is the earliest time the token may be used. This decoder converts those numbers into readable dates and tells you whether the token is still valid, not yet valid, or already expired.
The signature is the part that proves the token is genuine — but only the server that signed it, using its secret key, can check it. Anyone can decode a token and read it, because the header and payload are only encoded, not encrypted. That is why you should never put a password or a secret inside a token, and why a decoded token is never proof on its own. If you are debugging an API and the server rejects your token, decoding it here is the fastest way to spot the problem: a wrong user id, a missing role, or an expiry time that has already passed.
Worked example
Suppose your API returns a token for a test user and you want to check what it contains before sending it back. Press Load sample token and this token appears in the box:
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyXzQyIiwibmFtZSI6IkFsZXggTW9yZ2FuIiwicm9sZSI6ImFkbWluIiwiaWF0IjoxNzYwMDAwMDAwLCJleHAiOjE3NjAwODY0MDB9.c2lnbmF0dXJl
Step 1: The header decodes to {"alg": "HS256", "typ": "JWT"} — the token was signed with HS256.
Step 2: The payload decodes to {"sub": "user_42", "name": "Alex Morgan", "role": "admin", "iat": 1760000000, "exp": 1760086400}.
Step 3: The issued-at time, 1760000000, converts to Thu, 09 Oct 2025 08:53:20 GMT.
Step 4: The expiry time, 1760086400, converts to Fri, 10 Oct 2025 08:53:20 GMT — exactly 24 hours later, so this token is valid for one day.
The tool shows exactly those results: the header and payload as formatted JSON, a claims table with both dates in plain words, and the note that the signature was not verified. Paste your own token and the same four steps reveal whatever it carries.
FAQ
What is a JWT?
A JWT, or JSON Web Token, is a compact way to pass information between two parties as a single string. It has three parts separated by dots: a header that says how the token is signed, a payload that carries claims such as the user id and the expiry time, and a signature. Servers use JWTs to prove that a user is logged in without storing a session on the server.
Does this decoder verify the signature?
No. This tool decodes only — it reads the header and payload so you can see what is inside the token. It does NOT verify the signature, so a decoded token is not proof that the token is genuine or trustworthy. Only the server that holds the signing secret can verify a token properly.
Is it safe to paste my token here?
Your token never leaves your browser: all decoding happens on your own device and nothing is uploaded to a server. Even so, treat a real token like a password. A JWT can contain personal details and, if it is still valid, anyone holding it can use it as if they were you. Decode test tokens freely, but avoid pasting live production tokens from a real account.
How do I know if my token has expired?
Look at the exp claim in the payload, which holds the expiry time as a Unix timestamp. This decoder converts it to a readable date and tells you whether the token is still valid or has already expired. If the token has no exp claim, there is no built-in expiry to check, and the server decides how long it is accepted.
Why does my token fail to decode?
A JWT must have exactly three parts separated by dots, and the first two parts must be valid base64url-encoded JSON. The most common mistakes are a missing part, a copied token that includes extra spaces or quotation marks, or a token that was cut off when it was copied. Paste the whole token, with no spaces before or after it, and try again.