Skip to content

JWT Decoder

Read the header and payload of a JSON Web Token, with its expiry and issue times in your local time. Decodes only: it does not check the signature.

Private · on device. Runs in your browser: your file is not uploaded. No sign-up.

Your token

Paste a JWT (it starts "eyJ"). "Bearer " in front is fine.

Read a token in seconds

A JSON Web Token is three parts joined by dots: a header saying how it was signed, a payload of claims (who it is for, what it allows, when it expires), and a signature. The first two are only Base64url-encoded JSON, so anyone can read them; this tool does that and lays the result out with the times in your local zone.

Typical uses

  • Finding out why an API call returns 401: is the token expired, or for the wrong audience?
  • Checking which roles or scopes a login token carries.
  • Confirming that a token does not leak personal data in its payload, which anyone holding it can read.

Frequently asked questions

Does this check that the token is genuine?

No. It decodes the token so you can read it, and says so plainly. Checking the signature needs the secret or public key of the service that issued the token, and that check belongs on the server that relies on the token. A decoded payload is a claim, not proof.

Is it safe to paste a real token here?

The token is decoded in your browser and never sent anywhere. Even so, a live token is like a password while it is valid: do not paste it into sites you do not trust, and prefer expired or test tokens when you can.

How is the expiry shown?

The exp, iat, nbf and auth_time claims are seconds since 1 January 1970 (UTC). They are shown as dates and times in your own time zone, with how long ago or how soon, and the token is marked expired or not.

What does alg "none" mean?

That the token is not signed at all, so anyone could have written it. Servers should reject such tokens; the decoder warns you when it sees one.

Why does my token have five parts?

A five-part token is encrypted (a JWE), not just signed. Its contents cannot be read without the key, so the decoder says so instead of showing anything.