How to decode a JWT
- Paste the token into the Your JWT box. A leading
Beareris removed for you. - Read the header, the payload and the dates. The tiles at the top show the algorithm, the expiry state and times.
- Select Copy to copy the decoded text.
Decoding is not verifying
This tool decodes only. It does not verify the signature. Anyone can build a token with any claims, so a readable payload says nothing about whether it is genuine. Your server must check the signature with the right key and also check the issuer, audience and expiry before trusting a token.
What a JWT contains
A JSON Web Token has three parts separated by dots: header.payload.signature.
- The header names the signing algorithm (
alg) and the type. - The payload holds the claims, such as the user (
sub), the issuer (iss), the audience (aud) and times. - The signature lets the server detect tampering. It is shown as raw text here.
The first two parts are Base64URL-encoded JSON, not encrypted, so they can be read by anyone who has the token. Never put passwords or private data in a JWT payload.
Time claims
The decoder turns exp, iat and nbf from Unix seconds into UTC dates. If exp is present it also says whether the token has expired and how long ago or how soon. A token with no exp claim is labelled so, because such a token never expires on its own.
Tips
- Seeing a Base64 error? Check that you copied the whole token and no extra characters.
- Format the payload further with the JSON formatter.
- Read the raw parts yourself with Base64 encode and decode, using the URL-safe option.
Privacy
Tokens grant access, so they are sensitive. This page decodes them only in your browser. Nothing is uploaded, stored or logged, and no network request carries the token.