JWT Decoder
Paste a JSON Web Token and read what is actually inside it — header, payload, and every registered claim in plain English, with live expiry countdowns. The token is decoded on your device and never leaves this browser.
Your token
How to use this decoder
1. Paste the token
Drop in the whole string, including both dots. If you copied it from an Authorization header, the Bearer prefix and any wrapped line breaks are stripped for you. Decoding starts as you type — there is no submit step and no request to a server.
2. Read the claims table, not just the JSON
The raw payload shows exp: 2051222400, which tells you nothing at a glance. The claims table converts every registered claim into a sentence: who issued the token, who it is for, when it was minted, and exactly how long it has left before a server should refuse it.
3. Check the algorithm before you trust anything
The banner turns red when the header says alg: none or when the third part is empty. Both mean the token carries no signature, so its contents can be rewritten by anybody who has it. Real tokens should show HS256, RS256, ES256, or a similar named algorithm.
4. Remember what decoding does not prove
A JWT payload is base64url, not encryption — anyone who intercepts the token can read it exactly as you just did. Decoding shows you what the token claims. It cannot show you whether those claims are authentic, because that needs the signing key.
JWT decoding FAQs
Is my token sent to a server?
No. The decoding happens in JavaScript on your own device. There is no upload, no logging, and no network request carrying the token. That is the whole reason this page exists: a JWT is a live credential, and pasting one into a service that round-trips it to a backend hands somebody else a working key. Share links are deliberately switched off here for the same reason.
Why does this tool not verify the signature?
Verifying a signature requires the secret or public key that signed the token, and this page has neither. Anything claiming to verify without a key is only reading the alg field, which an attacker controls. Decoding tells you what the token says; only your backend, holding the real key, can tell you whether the token is genuine.
What do iat, nbf, and exp mean?
They are timestamps measured in seconds since 1 January 1970 UTC. iat is when the token was issued, nbf is the earliest moment it may be accepted, and exp is the moment it must be rejected. This page converts all three into readable dates and counts down to the expiry so you can see at a glance whether a token is still inside its window.
What does an alg of none mean?
It means the token carries no signature at all, so anybody can edit the payload and the token still parses. Historically several libraries accepted such tokens by mistake, which let attackers mint their own admin sessions. If you see alg: none on a token your system accepted, treat it as a serious bug and pin the expected algorithm on the verifying side.
Can this decode an encrypted token (JWE)?
No, and nothing else can either without the decryption key. A JWE has five dot-separated parts instead of three and its payload is ciphertext. This page detects that shape and tells you rather than showing you nonsense.
Why does my token show as expired when my app still accepts it?
Expiry is judged against your device clock, so a clock that drifts by minutes will shift the countdown. Most verifiers also allow a small leeway, often 30 to 60 seconds, to absorb that drift. If the gap is hours rather than seconds, check the time zone on the machine running your service instead.