JWT Decoder
Paste a JSON Web Token to inspect its header, payload and claims. See exactly when it expires in your local time, and catch insecure alg: none tokens — without your token ever leaving the browser.
What Is a JSON Web Token?
A compact, URL-safe way to pass signed claims between systems.
A JWT (RFC 7519) is three Base64URL-encoded parts separated by dots: a header describing the signing algorithm, a payload of claims such as the user ID and expiry time, and a signature that proves the token hasn't been tampered with.
JWTs are used for API authentication, single sign-on (OpenID Connect ID tokens), OAuth 2.0 access tokens and session cookies. Decoding one is the fastest way to debug “401 Unauthorized” errors, check roles and scopes, or see why a token is rejected.
The header and payload are only encoded, not encrypted — anyone holding the token can read them. Never put passwords or secrets in a JWT payload.
This tool decodes tokens; it does not verify the signature, because that requires the secret or public key. Never trust a token's contents in your application without verifying it server-side with a proper JWT library.
Registered JWT Claims
The standard claims from RFC 7519 shown in the claims table.
| Claim | Name | Meaning |
|---|---|---|
iss | Issuer | Who created and signed the token (e.g. your auth server URL). |
sub | Subject | Who the token is about — usually the user ID. |
aud | Audience | Which API or app the token is meant for. Can be a string or an array. |
exp | Expiration time | Unix timestamp (seconds) after which the token must be rejected. |
nbf | Not before | Unix timestamp before which the token is not yet valid. |
iat | Issued at | Unix timestamp of when the token was created. |
jti | JWT ID | A unique identifier, used to prevent token replay. |
How to Use the JWT Decoder
Get your result in under ten seconds.
Paste your token
Paste a JWT from an Authorization header, cookie or log. A “Bearer ” prefix is removed for you.
Inspect the claims
Read the pretty-printed header and payload, and see exp, iat and nbf as local dates with “in 5 minutes” style times.
Check the status
The banner tells you if the token is valid, expired, not yet active or unsigned.
Why Use the JWT Decoder on Developers Web Tools
Fast, accurate and private — built for developers.
Private by design
Tokens are decoded in your browser — never transmitted, saved to storage or written to the console.
Human-readable times
Unix timestamps are shown as your local date and time, plus how long ago or until.
Instant status
See at a glance whether a token is valid, expired or not yet valid.
Security warnings
Flags unsigned alg: none tokens and recognises encrypted JWE tokens.
Colour-coded parts
Header, payload and signature are highlighted so you can see the token's structure.
Unicode-safe
Payloads with names in any language and emoji decode correctly as UTF-8.
Frequently Asked Questions
The token is decoded with JavaScript on your device. It is not sent over the network, not saved in localStorage or cookies and not logged, and Clear wipes it from the page. Still, treat live tokens like passwords: prefer expired or test tokens when you can, and never share them in tickets or chats.
No. Verification needs the signing secret (HS256) or the issuer's public key (RS256/ES256), and checking signatures in a web page encourages pasting secrets. Verify tokens server-side with a maintained JWT library.
The exp claim is earlier than your computer's current time. Tokens are often short-lived (5–60 minutes). If a fresh token shows as expired, check that your device clock is correct — the tool uses your local time.
The token has no signature, so anyone can forge it. Servers must never accept unsigned tokens; accepting them has caused serious real-world vulnerabilities.
A JWE (JSON Web Encryption) has five parts instead of three, and its payload is encrypted. Only the header can be read without the decryption key, so the tool shows the header and explains this.
JWT times are Unix timestamps — seconds since 1 January 1970 UTC. The claims table converts them to your local date and time. For other timestamps, use the Unix Timestamp Converter.