Security / Data tool
JWT Decoder
Decode a JSON Web Token header and payload locally. Decoding does not verify the signature.
Result
Your result will appear here.
How to use JWT Decoder
- Paste a three-part JWT.
- Inspect the decoded header, payload, and signature section.
Example
eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiJzYW1wbGUiLCJpYXQiOjE3MDAwMDAwMDB9.Common use cases
- Checking which user, scope, or tenant a token carries when an API returns a 401 or 403 response during debugging.
- Reading the exp claim to confirm when a token will expire before a long-running script or test run starts.
- Comparing the header of tokens from two services to see which signing algorithm each one uses.
Input and output examples
| Input | Output | Notes |
|---|---|---|
eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiJzYW1wbGUiLCJpYXQiOjE3MDAwMDAwMDB9. | {"sub":"sample","iat":1700000000} | Payload. The unsigned example has an empty signature, and issuedAt is 2023-11-14T22:13:20.000Z. |
eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiJzYW1wbGUiLCJleHAiOjE3MDAwMDM2MDB9. | expiration: 2023-11-14T23:13:20.000Z | The exp claim 1700003600 is read as seconds. |
Common mistakes to avoid
- Decoding is not verification. A forged token with alg set to none decodes without any error, so verify the signature with a maintained JWT library and your server’s key before you trust any claim.
- Claim dates are seconds. iat, exp, and nbf count seconds since 1970, not milliseconds, so a value copied from Date.now() shows the wrong date.
- Paste the whole token. The decoder needs all three dot-separated sections. A token with an empty signature still decodes, but a token without its second dot is rejected.
Technical details
The header and payload are decoded from Base64URL (RFC 4648, section 5) and parsed as JSON. The token layout follows RFC 7519 (JSON Web Token) and the JWS format in RFC 7515. The iat, exp, and nbf claims are NumericDate values, meaning seconds since 1970-01-01 UTC, and are shown as ISO 8601 text. No cryptographic signature check is performed.
Frequently asked questions
Is this JWT verified?
No. The token is only decoded. The signature is shown as text and has not been checked against any key.
Is it safe to paste a live token?
The tool does not send the token to a server. However, anyone who holds a valid token can use it until it expires, so treat it as a credential and avoid pasting it on a shared computer.
Why does the expiration date look far in the future?
The exp claim is read as seconds. A value written in milliseconds, which is common in JavaScript, is read as a date thousands of years ahead.
Can the tool decode an encrypted JWE token?
No. A JWE token has five dot-separated sections, and the decoder accepts only three. Encrypted tokens need a key to read.
Why can anyone read the payload if the token is signed?
A JWS payload is encoded, not encrypted. The signature only proves that the content was not changed. Do not put secrets in claims that you expect to stay private.
What does iat mean?
iat is the “issued at” claim: the time the token was created, as seconds since 1970-01-01 UTC.