Decoding happens in your browser. The token is never sent anywhere.
Header
{
"alg": "HS256",
"typ": "JWT"
}Payload
{
"sub": "1234567890",
"name": "Jane Doe",
"email": "jane@example.com",
"role": "editor",
"iat": 1767225600,
"nbf": 1767225600,
"exp": 1798761600
}Time claims
| Issued at (iat) | 2026-01-01 00:00:00 UTC 1767225600 | |
|---|---|---|
| Not before (nbf) | 2026-01-01 00:00:00 UTC 1767225600 | |
| Expires (exp) | 2027-01-01 00:00:00 UTC 1798761600 |
Signature
c2FtcGxlLXNpZ25hdHVyZS1ub3QtdmFsaWQ
The signature is shown as-is and is not verified. Anyone can create a token with any payload, so never trust these claims until your server has checked the signature with the correct key.
How to use the JWT Decoder
- 1Paste your token into the JSON Web Token box. A sample token is filled in so you can see how the tool works; a leading Bearer prefix is ignored.
- 2Read the decoded header and payload in the two panels and use Copy to grab either one as JSON.
- 3Check the Time claims table for iat, nbf and exp dates and the Expired, Valid or Not yet valid badges.
- 4Review the raw signature, and remember that this tool does not verify it.
What is a JWT?
A JSON Web Token is a compact, URL-safe way to pass a set of claims between two parties. It is widely used for login sessions, API access tokens and single sign-on through OAuth 2.0 and OpenID Connect. A token is three Base64URL-encoded parts joined by dots: header.payload.signature.
The header names the signing algorithm, such as HS256 or RS256, and the token type. The payload holds the claims: who the token is about (sub), who issued it (iss), who it is for (aud), when it expires (exp) and any custom data the application adds, such as a role or email address.
How decoding works
The header and payload are not encrypted. Each is JSON text converted to UTF-8 bytes and then encoded with Base64URL, a variant of Base64 that uses - and _ instead of + and / and drops the = padding. Decoding simply reverses those steps, which is why anyone who holds a token can read it. Our guide to Base64 encoding explains the format in more detail.
Time claims are stored as Unix timestamps: whole seconds since 1 January 1970 UTC. In the sample token, iat is 1767225600, which is 2026-01-01 00:00:00 UTC, and exp is 1798761600, which is 2027-01-01 00:00:00 UTC. The tool shows each as a UTC date and, once the page has loaded, how long ago or how far in the future it is compared with your device clock. To pretty-print other JSON you copy out, use the JSON formatter.
Decoding is not verifying
The signature is what makes a JWT trustworthy. The issuer computes it over the header and payload with a secret key (HMAC) or a private key (RSA or ECDSA), and the receiving server recomputes or checks it with the matching key. If even one character of the payload changes, verification fails.
This tool deliberately does not verify signatures, because that requires the key, which should never be pasted into a website. A token that decodes cleanly may still be forged, expired or issued for a different audience. Always validate tokens on your server with a maintained JWT library, check exp, nbf, iss and aud, and reject the alg value none.
Keeping tokens safe
Because the payload is readable by anyone, never put passwords, card numbers or other secrets in it. Treat a valid access token like a password while it is unexpired: anyone who has it can use it. Prefer short expiry times, and avoid sharing real tokens in screenshots, chat or bug reports.
Learn more
Frequently asked questions
Is it safe to paste my token here?
The decoding runs entirely in your browser and the token is not sent or stored anywhere. Even so, a live token grants access, so for production tokens it is good practice to use one that has expired or been revoked.
Why does the tool say my token is expired?
The exp claim is earlier than the current time on your device. If the time looks wrong, check your computer's clock and time zone, since the comparison uses your local clock. Servers often allow a small clock skew of a minute or so.
Can I edit the payload and use the token?
You can change the decoded text, but the signature will no longer match, so any correctly configured server will reject the token. Only the holder of the signing key can create a valid token.
What does an error about five parts mean?
A token with five dot-separated parts is an encrypted JWE rather than a signed JWT. Its payload is encrypted and cannot be read without the decryption key.
What is the difference between a JWT and a hash?
A JWT carries readable data plus a signature that proves who created it. A hash is a one-way fingerprint of data that cannot be reversed. You can create SHA-256 and other fingerprints with the hash generator.