Paste a JSON Web Token to read its header and claims, with expiry times turned into dates. Everything stays in your browser.
Runs entirely in your browser. Nothing you enter is sent to a server.
Decoding is not verifying. This tool does not check the signature, so a token that decodes is not necessarily genuine. Avoid pasting live production tokens or secrets into any site you do not trust.
Header
Signature
Payload
Time claims
How it works
A signed JWT is three base64url strings separated by dots: header.payload.signature. The header says which algorithm and key type were used, the payload carries the claims, and the signature lets a server that holds the key prove the first two parts were not altered. This tool decodes the first two parts as UTF-8 JSON using your browser’s built-in functions.
Time claims (exp, iat, nbf) are seconds since 1 January 1970 UTC. The tool shows each as a UTC date, in your local time and relative to now, and checks exp and nbf against your device’s clock. Decoding is not verifying: the signature is shown but never checked.
Common uses
Debugging an authentication problem by checking which claims, scopes and audience a token carries.
Finding out why a token was rejected: expired, not yet valid or issued by the wrong issuer.
Learning how OAuth 2.0 and OpenID Connect tokens are structured.
Confirming the signing algorithm in the header before configuring a verifier.
Frequently asked questions
Is decoding a JWT the same as verifying it?+
No. The header and payload of a JWT are only base64url-encoded, so anyone can read them. Verifying means checking the signature with the right key or secret and validating claims such as exp, iss and aud. This tool decodes only; it never checks a signature, so do not treat anything it shows as trusted.
Is it safe to paste a token here?+
This page decodes entirely in your browser and sends nothing anywhere. Still, a live token is a credential: anyone holding it can use it until it expires. As a habit, avoid pasting production tokens into any online tool you do not control, and prefer expired or test tokens.
What do exp, iat and nbf mean?+
They are registered claims from RFC 7519, each a NumericDate in seconds since 1970-01-01 UTC. exp is when the token expires, iat is when it was issued and nbf is the time before which it must not be accepted.
Why does my token have five parts instead of three?+
Five dot-separated parts mean an encrypted token (JWE) rather than a signed one (JWS). Its payload is encrypted, so it cannot be read without the decryption key.
Why does the status say expired when my server accepts the token?+
This tool compares exp with your device’s clock. If your clock is off, or the server allows some clock skew, the results can differ for tokens that are close to their expiry time.
These tools are free to use. If you need cloud and DevOps, web or mobile development, CRM integrations or managed IT support, tell us what you are working on.
