JWT Decoder: Read a Token's Header, Payload and Expiry, and Verify Its Signature
This JWT decoder splits a JSON Web Token into its Header and
Payload and shows both as indented JSON the moment you paste it. Timestamp claims such as
exp get a readable local date beside them, and a badge tells you whether the token has expired.
Checking the signature is optional. The token is read in your browser and never uploaded.
How to Decode a JWT
- Paste the token into the JSON Web Token box. The Header and Payload blocks appear straight away; there is no Decode button to press.
- Read the status badges above the result: whether the token is expired, not valid yet or has no expiry, and the state of its signature.
- Select Copy header or Copy payload to copy that block as plain JSON. The date notes are not included in the copy.
- Select Clear to empty the box and start with another token.
You can paste the token as it came. A leading Authorization: Bearer, quotation marks around it and
line breaks are all stripped, so copying from a request header, a log line or a JSON response works. The box takes
up to 100,000 characters. Large numbers and non-English text in the claims are shown exactly, and long values wrap
instead of running off the screen.
What the Header and Payload Contain
A JWT is three base64url parts joined by dots: header.payload.signature. The first two are plain
JSON, only encoded, which is why a JWT can be decoded without any secret. The common claims you will see are:
| Claim | Meaning |
|---|---|
iss | Issuer: who created the token |
sub | Subject: who the token is about |
aud | Audience: who the token is meant for |
exp | Expiry time |
nbf | Not valid before this time |
iat | Issued at this time |
jti | Unique token ID |
The header normally holds alg (the signing algorithm), typ and sometimes
kid, the ID of the key that signed it.
Check If a JWT Is Expired
exp, iat, nbf and auth_time are Unix timestamps in seconds.
The tool writes each one as a local date and time next to the number, so you can read it without converting it.
The badges above the result use your device's clock:
- Expired 2 days ago or Expires in 3 hours, from the
expclaim. - No expiry: the token has no exp claim when
expis missing. - Not valid yet when
nbfis still in the future.
Verify the JWT Signature
Decoding shows what a token says; only the signature shows that it was not changed. Below the result is
Verify the signature (optional). Leave Algorithm on its auto-detect
choice, which reads alg from the token, or pick one yourself: HS256, HS384, HS512, RS256, RS384,
RS512, PS256, PS384, PS512, ES256, ES384, ES512 or EdDSA. Then paste a key into
Secret or public key:
- A plain secret for the HS algorithms. It is used exactly as typed, not base64-decoded first.
- A PEM public key (
-----BEGIN PUBLIC KEY-----) or an RSA public key in PKCS#1 form. - An X.509 certificate.
- A JWK, or a whole JWKS, in which case the key is chosen by the token's
kid.
The badge changes to Signature valid or Signature invalid. Without a key it
stays at Signature not verified. A token that says alg is none shows
No signature: this token is unsigned. If you paste a private key, the tool refuses it and asks for
the public key, which is all that verification needs. The check runs on your browser's own WebCrypto;
EdDSA needs a recent browser.
When a Token Will Not Decode
The error appears under the box and names the part at fault:
- The text does not have three parts separated by two dots, and the message says how many it found.
- The header, payload or signature is not valid base64url, often a character lost when copying.
- The header or payload is not valid UTF-8 text, or not valid JSON.
- A token with five parts is an encrypted JWE. It is recognised and explained, but it cannot be read without the private key.
Is It Safe to Paste a Token Here?
The token and any key are decoded and checked on your device. Nothing is uploaded, nothing is saved, and there is no account. Even so, a live access token is a credential, so prefer expired or test tokens when you can.
Frequently Asked Questions
Can I decode a JWT without the secret?
Yes. The header and payload of a JWT are only base64url-encoded, not encrypted, so anyone holding the token can read them. Paste it into the JSON Web Token box and both appear at once. The secret or public key is needed only to check the signature, which is optional here.
How do I check if a JWT is expired?
Paste the token and read the badge above the result. It says Expired with how long ago, or Expires with the time left, taken from the exp claim. A token with no exp claim shows No expiry, and a token whose nbf is still in the future shows Not valid yet.
How do I convert a JWT exp value to a date?
You do not have to convert it. exp is a Unix timestamp in seconds, and the tool writes the matching local date and time beside it in the Payload block. The same is done for iat, nbf and auth_time.
How do I verify a JWT signature with a public key?
In Verify the signature (optional), leave Algorithm on auto-detect or pick the one the token uses, and paste the public key into Secret or public key. A PEM key (-----BEGIN PUBLIC KEY-----), an RSA PUBLIC KEY, an X.509 certificate, a JWK or a JWKS all work. The badge then changes to Signature valid or Signature invalid.
Can I decode a JWT token locally, without sending it to a server?
Yes, that is how this tool works. The token is split, decoded and checked in your browser, and nothing is uploaded or saved. Signature checks use the browser's own WebCrypto, so no token or key is sent anywhere.
What is in a JWT header and payload?
The header describes the token, usually its signing algorithm (alg), its type (typ) and sometimes a key ID (kid). The payload holds the claims, such as who issued it (iss), who it is about (sub), who it is for (aud) and when it expires (exp). Both are plain JSON, shown in the Header and Payload blocks.
What do exp, iat and nbf mean in a JWT?
exp is the time the token stops being valid, iat is the time it was issued, and nbf is the time before which it must not be accepted. All three are Unix timestamps in seconds. This tool shows each as a local date and time, and turns exp and nbf into the expiry badges.
What does alg none mean in a JWT?
It means the token declares itself unsigned: the signature part is empty and nothing can be checked. The tool shows No signature: this token is unsigned. A server should never accept such a token as proof of identity.
How do I decode a bearer token?
If it is a JWT, paste it as it is. A leading Authorization: Bearer, surrounding quotes and line breaks are stripped for you, so you can copy straight from a request header or a log. An opaque bearer token that is not three dot-separated parts cannot be decoded, and the tool says how many parts it found.
Can I decode an encrypted JWT (JWE)?
No. A token with five parts is a JWE, and its contents are encrypted, so they cannot be read without the private key. The tool recognises it and says so instead of showing an error.
Can I create or sign a JWT here?
No. This tool only reads and checks tokens. It does not generate, sign or edit them, and it does not decrypt JWE tokens.
Recommended
-
Yubico Security Key C NFCDone debugging logins? Protect your own accounts with a phishing-proof USB-C key.
-
YubiKey 5C NFC Security KeyAdds OTP, smart card and FIDO2 in one key, handy when you build and test auth flows.
-
Rain Design mStand Laptop StandLifts your laptop to eye level for long sessions of reading tokens and logs.
Helps keep the tools free. ✨
Images are for illustration only. As an Amazon Associate I earn from qualifying purchases.
