Skip to content

JWT Decoder

Decode the header and the payload of a JSON Web Token and read its time claims. It does not verify the signature.

JWT decoder
Paste a token. It is decoded here and never sent.

Result
HS256
Algorithm (alg)
Present, 43 characters. Not verified.
Signature

Header
{
  "alg": "HS256",
  "typ": "JWT"
}
Payload
{
  "sub": "1234567890",
  "name": "John Doe",
  "iat": 1516239022
}
Time claims (UTC)
Issued at (iat): 2018-01-18T01:30:22Z

Private: Everything runs in this page. Nothing you type is sent anywhere or saved.

Updated

On this page
  1. How the three parts decode
  2. Formula
  3. How the jwt decoder works
  4. What this tool does not do
  5. Frequently asked questions
  6. References
  7. Related tools

How the three parts decode

Part (Base64URL)Decoded text
eyJhbGciOiJIUzI1NiJ9{"alg":"HS256"}
eyJ0eXAiOiJKV1QiLCJhbGciOiJub25lIn0{"typ":"JWT","alg":"none"}
eyJzdWIiOiJ1c2VyMSIsImV4cCI6MTcwMDAwMDAwMH0{"sub":"user1","exp":1700000000}
eyJhIjoxfQ{"a":1}
eyJuYW1lIjoiQW5hIn0{"name":"Ana"}

Formula

token = base64url(header) . base64url(payload) . signature

How the jwt decoder works

  1. Step onePaste the token. A leading word Bearer is removed for you.
  2. Step twoRead the header (the algorithm) and the payload (the claims) in the two boxes.
  3. Step threeCheck the time claims: iat is when it was issued, nbf when it starts, exp when it ends.

What this tool does not do

  • It does NOT verify the signature, so a token that decodes here may still be forged or changed.
  • It cannot read encrypted tokens (JWE with five parts); that needs the key.
  • The expiry check uses this device's clock, which may be wrong.

Frequently asked questions

Does this tool check the signature?

No. It only decodes the first two parts, which anyone can read. To trust a token, your server must verify the signature with the right key.

Is my token sent anywhere?

No. It is decoded inside this page. Still, treat real tokens like passwords and prefer expired or test tokens.

Why can I read the payload without a key?

A signed token is not encrypted. Its parts are only encoded, so never put secrets in a payload.

References