JWT decoder
Read the header and payload of a JWT and check its expiry
Token
The token is decoded in your browser: it is never sent anywhere. The signature is not verified (that would need the secret key).
Paste a token on the left to decode it.
About this tool
The JWT decoder shows what is inside a JSON Web Token without needing the key: the header, with the algorithm and token type, and the payload, with claims such as the user ID, roles or scopes, pretty-printed as JSON. Use it to debug an authentication flow, to check what an API actually receives, or to understand why a token is being rejected.
The exp, iat and nbf claims are converted to readable dates and relative times, and a badge tells you whether the token is valid, expired, not yet valid or has no expiry date. A “Bearer” prefix copied along with the token is stripped automatically. The signature is not verified: that would require the secret or public key, which the tool never asks for.
How to use it
- Paste your token (eyJ…) into the Token field.
- Check the badge under “Token dates”: Valid, Expired, Not yet valid or No expiry date.
- Read the Expires, Issued and Valid from dates, along with how far they are from now.
- Review the Header and Payload, then click “Copy” to grab the payload as JSON.
Frequently asked questions
Does the tool verify the token signature?
No. Verifying a signature requires the secret key (HS256) or the public key (RS256, ES256), and the tool does not ask for it. It only decodes the header and payload, which anyone can read, so a token decoded here is not necessarily authentic.
How is the Expired status determined?
The tool compares your computer's clock with the exp claim, expressed in seconds since 1970. If nbf is in the future, the token is “Not yet valid”, and without exp it shows “No expiry date”. A wrong local clock will skew the status.
Is it safe to paste a real token?
The token is decoded in your browser and never sent anywhere: the page makes no network request to process it and does not store it. A token that is still valid remains sensitive data, though, so avoid sharing it elsewhere.
Why do I get “A JWT has three parts separated by dots”?
A signed JWT is made of three Base64 URL segments separated by dots: header, payload and signature. A truncated token, an encrypted token (JWE) with five parts, or a partial copy will all trigger this message.