What is inside a JWT
A JSON Web Token has three parts separated by dots: header.payload.signature. The header and payload are JSON documents encoded as base64url; the signature is binary data that proves the token was issued by someone holding the key. Decoding is just reversing the encoding, so anyone who has the token can read it. That is why you should never put secrets in a JWT payload.
Paste the token (a leading Bearer is stripped for you) and the decoder shows the pretty-printed header and payload. Registered claims are explained in a table: iss issuer, sub subject, aud audience, exp expiry, nbf not before, iat issued at and jti token ID, with the time claims converted to readable UTC dates. A banner tells you whether the token has expired or is not yet valid.
This tool decodes but does not verify. Checking a signature requires the secret or public key and should be done by your server. A token that decodes fine may still be forged or tampered with.
Worked example
Token:
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5cHeader: {"alg": "HS256", "typ": "JWT"}. Payload: {"sub": "1234567890", "name": "John Doe", "iat": 1516239022}. The iat value 1516239022 is 2018-01-18 01:30:22 UTC. There is no exp claim, so the token never expires, which is usually a design smell for access tokens.
Privacy and safety
- The token is decoded by JavaScript in this page. It makes no network request, is not written to storage and is never added to the URL, so there is no share link on this page.
- Still, real access tokens are credentials. Prefer expired or test tokens, and revoke any production token you have pasted into a tool you do not control.
- Watch for
alg: none(unsigned tokens, which servers must reject) and unexpectedly long lifetimes. - Encrypted tokens (JWE, five parts) cannot be read without the key.
- To convert timestamps by hand, use the timestamp converter.
Frequently asked questions
Is it safe to paste a real token here?
The decoder never sends the token anywhere, so the page itself is safe. But tokens are bearer credentials: anyone holding a valid one can use it. Use test or expired tokens when you can, and rotate any token you may have exposed.
Does this tool verify the signature?
No. Verification needs the signing secret or public key and belongs on your server. This tool only decodes the readable parts.
Why can I read the payload if the token is signed?
Signing proves who issued the token and that it was not modified; it does not hide the content. Base64url is an encoding, not encryption. Put sensitive data in the server session instead, or use an encrypted JWE.
What does an expired token message mean?
The exp claim, a Unix time in seconds, is in the past compared with your device clock. The server rejects such tokens, so request a new one using your refresh flow.