JWT decoder
See what is inside a JSON Web Token.
Claims
| Claim | Value | Meaning |
|---|
This tool decodes tokens but never verifies signatures. Your token stays in this browser tab.
Runs in your browser. Nothing you type is sent anywhere.
- Readable exp and iat dates
- Expiry status at a glance
- Token stays on your device
How to decode a JWT
- Paste the token, with or without the Bearer prefix.
- Read the header and payload, shown as formatted JSON.
- Check the claims table for the issuer, audience and expiry.
The three parts of a JWT
| Part | Encoding | Contains |
|---|---|---|
| Header | Base64url JSON | Signing algorithm (alg) and token type (typ) |
| Payload | Base64url JSON | The claims: the token's actual data |
| Signature | Base64url bytes | Proof the header and payload were not changed |
Common signing algorithms
| alg value | Type | Note |
|---|---|---|
| HS256 | Symmetric, shared secret | Common for a single app that issues and checks its own tokens |
| RS256 | Asymmetric, RSA | Common when another party needs to verify the token, like OAuth |
| ES256 | Asymmetric, elliptic curve | Shorter signatures than RSA for the same security level |
| none | No signature | A verifier should always reject this algorithm |
Standard claims, from RFC 7519
- exp, nbf and iat are all NumericDate values: whole seconds since the Unix epoch, never milliseconds.
- aud can be a single string or an array of strings, when a token is meant for more than one audience.
- jti is meant to be unique per token, which is what makes blocklisting one specific token possible.
- None of the standard claims are required. A token can carry only the custom claims an application defines.
JWT decoder FAQ
What are the three parts of a JWT?
A header, a payload and a signature, each base64url-encoded and joined with dots. The header names the signing algorithm, the payload holds the claims, and the signature lets the server check who issued the token.
Does this tool verify the signature?
No. It decodes the header and payload and never checks the signature. Verify tokens on your server with the secret or public key before trusting them. The token you paste never leaves your browser.
Is the payload of a JWT encrypted?
Not in a normal signed JWT. It is only encoded, so anyone holding the token can read it, which is why passwords and private data should never go in one. Encrypted tokens (JWE) have five parts and need the key.
What do exp, iat and nbf mean?
They are times in seconds since January 1, 1970 (UTC). exp is when the token expires, iat is when it was issued, and nbf is the time before which it must not be accepted.
Why does my token show as expired?
Its exp time is earlier than your device clock. Access tokens often last only 5 to 60 minutes, so request a new one, and check that your computer's clock is set correctly.
What does RFC 7519 define?
It defines the JWT format itself: three base64url parts joined by dots, and the meaning of the standard claims like iss, sub, exp and aud. It does not require any particular signing algorithm.
Can a JWT be revoked before it expires?
Not by the token itself, since it is just signed data. Revoking one early needs server-side support, such as a blocklist keyed on the jti claim, or a short expiry paired with a separate refresh token.
Why do exp and iat show as large numbers instead of dates?
They are stored in the token as NumericDate values, whole seconds since the Unix epoch (January 1, 1970 UTC). This page shows the raw number next to a readable date for convenience.