JWT Decoder
Decode a JSON Web Token's header and payload. The token is never sent anywhere
Loading the tool…
Decodes a JSON Web Token: paste it to see the header and payload as JSON, with time claims such as the expiry turned into readable dates. Use it to check a token's contents and whether it has expired when a login or API call fails.
How to use
- Paste a JWT starting with eyJ into "Token". A leading "Bearer " is ignored.
- Look at the JSON in "Header" and "Payload" and at the "Signature" part.
- In the "Claims" table, read the issue and expiry times and a status such as "Expired" or "In effect".
- To check whether the token can be trusted, enter the secret or public key under "Verify the signature (optional)".
How it works
- A JWT has three parts separated by dots: header.payload.signature. The first two are Base64url-encoded JSON, so they can be read without a key. exp, nbf and iat are seconds since 1 January 1970 (UTC).
- Verification uses Web Crypto for HS, RS, PS and ES (256/384/512), and EdDSA where the browser supports it. Public keys can be given as PEM, a certificate, a JWK or a JWKS. Tokens with alg "none" get a warning.
- Decoding and verification run in your browser; the token and keys are not stored or sent. Even so, prefer test tokens or expired tokens to tokens from live systems.
Questions and answers
- How do I check when a JWT expires?
- Paste the token. "Expires at" (exp) in the "Claims" table shows the date and time, and the status column shows the time left or "Expired".
- Is a JWT encrypted?
- A normal JWT (JWS) is signed, not encrypted, so anyone can read its contents. Do not put passwords or other secrets in it. A token with 5 parts is an encrypted JWE and cannot be read without the key.
- Does decoding prove that a token is genuine?
- No. Anyone can change the contents, so only a signature checked with the right key can be trusted. Enter the key under "Verify the signature (optional)" to see "Signature valid" or "Signature invalid".