Developer Tools
JWT Decoder
Read the header, payload and times inside a JSON Web Token in your browser, without sending the token anywhere.
- Free
- No sign-up
- Runs in your browser
Decoding shows what is inside a token; it does not prove the token is genuine. Only the server that holds the key can check the signature. Your token is decoded in this page and is never sent anywhere.
How to use JWT Decoder
How to use this tool:
- Paste a token that looks like xxxxx.yyyyy.zzzzz. A "Bearer " prefix is fine.
- Read the header and payload as formatted JSON.
- Check the times (exp, nbf, iat) shown in UTC, and whether the token is inside its time window now.
Details. Decoding only reads the token. It does not check the signature, which needs the key, so it cannot show that a token is genuine. Warnings are shown for an unsigned token (alg none) or a time claim that is not a number. Encrypted tokens (five parts) cannot be read.
Privacy. The token is decoded in your page and never sent. Even so, avoid pasting live production tokens into tools you cannot inspect.
Examples
The jwt.io example token
Header HS256 and JWT, payload with sub 1234567890, name John Doe and iat 1516239022 (18 January 2018).
A token with exp
Shows the expiry in UTC and says if it has passed.
alg none
Shows a warning, because an unsigned token proves nothing.
Frequently asked questions
Does decoding prove a token is valid?
No. Only a check of the signature with the right key does, and that must be done on a server.
Can anyone read what is in a token?
Yes, anyone who has it can read the header and payload. Do not put secrets in them.
What are exp, nbf and iat?
They are the expiry, not-before and issued-at times, in seconds since 1 January 1970 UTC.
Is it safe to paste a token here?
It is decoded in your browser and not sent. Still, treat live tokens as passwords and prefer test tokens.
Guides about JWT Decoder
Related tools
Base64 Encoder and Decoder
Encode text to Base64 or decode Base64 back to text, including the URL-safe form and non-English characters.
aGVsbG8=Developer ToolsUnix Timestamp Converter
Convert a Unix timestamp to a date in UTC and India time, or a date and time to a timestamp, in seconds or milliseconds.
1700000000Developer ToolsHash Generator (SHA-256 and more)
Get the SHA-1, SHA-256, SHA-384 and SHA-512 hashes of any text, and check them against a hash you were given.
Hashes