What is a JWT?
A JSON Web Token (JWT, RFC 7519) is a compact, signed way to pass claims, such as who a user is and when their login expires, between a sign-in service and an app or API. You'll find them in Authorization headers, OAuth and OpenID Connect flows, and single sign-on.
When debugging auth, you often need to see what's inside: which user, which roles, which audience, and whether it's expired. This decoder splits the token, decodes the header and payload, names the registered claims and converts their timestamps to readable dates, without sending the token anywhere.
How to use the JWT Decoder
1.Paste the token
Copy it from an Authorization header or browser storage; a Bearer prefix is ignored.
2.Read the claims
Header and payload appear as formatted JSON, with each standard claim explained.
3.Check the expiry
exp, iat and nbf are shown as dates, and you're told whether it has expired.
Example: the jwt.io sample token
The well-known example token pre-filled on this page decodes to:
- Header
- { "alg": "HS256", "typ": "JWT" }
- sub (subject)
- 1234567890
- name
- John Doe
- iat (issued at)
- 2018-01-18T01:30:22Z
It has no exp claim, so it never expires, which is fine for a demo and a bad idea in production.
Decoding isn't verifying
A JWT is three Base64url parts separated by dots: a header saying how it's signed, a payload of claims, and a signature. The first two are only encoded, not encrypted, so anyone holding the token can read them, which is why JWTs must never contain secrets.
This tool doesn't check the signature: that needs the issuer's secret or public key, and a server must always verify it before trusting the claims. Treat tokens like passwords, and don't paste live production tokens or signing keys into any website.
Frequently asked questions
Is it safe to decode a JWT here?
Nothing is sent anywhere, but a valid token can still grant access if it leaks. Use test tokens, or ones that have already expired.
Can you read a JWT without the secret?
Yes. The header and payload are just Base64url-encoded JSON. The secret is only needed to verify or create the signature.
What does exp mean?
The expiry time, in seconds since 1970. Servers reject the token after it.
Why won't my token decode?
It needs exactly three dot-separated parts. A five-part token is an encrypted JWE, which can't be read without its key.
Related tools
Base64 Encoder & Decoder
Base64 and Base64url for text (UTF-8) and files.
JSON Formatter & Validator
Pretty-print, minify, sort and validate JSON with line-numbered errors.
Unix Timestamp Converter
Epoch time to date and back, in seconds or milliseconds.
Hash Generator: MD5, SHA-1, SHA-256
MD5, SHA-1 and SHA-256 hashes of text or files, with checksum compare.
URL Encoder & Decoder
Percent-encode or decode URLs and query values, and see a URL's parts.
JSON ↔ CSV Converter
Convert JSON arrays to CSV and CSV back to JSON.