TEXT & DEVELOPER TOOLS
JWT Decoder
Paste a JSON Web Token to read its header and payload and see when it was issued and when it expires.
Quick answer: Paste the token (a leading “Bearer ” is removed automatically), run the operation, and read the header, payload and the issued, not-before and expiry times.
Use JWT Decoder ↓Loading the tool…
How to use JWT Decoder
- Paste the tokenThe operation is already set to “Decode a JWT”. Paste the three dot-separated parts. You can include a leading “Bearer ”.
- Run the operationThe header and payload are decoded from Base64url and shown as formatted JSON.
- Read the timesIf the token has iat, nbf or exp claims, they are converted to readable UTC dates, and expiry is marked as expired or still valid.
- Remember what it did not checkDecoding is not verification. The signature is not checked, so do not treat a decoded token as proof that it is genuine.
About this tool
When an API call fails with a 401, the first question is usually what is inside the token: who is it for, which scopes does it carry and has it expired? A JWT is just Base64url-encoded JSON, so you can read it without any secret. This page does that in your browser, and since access tokens are credentials, not having to paste them into a website that sends them to a server matters.
Practical example: Paste a token from a failed request, see that exp is two hours in the past, and conclude that the client needs to refresh its token.
Important limitation: Decoding only. No signature verification, no checking of issuer or audience, and no handling of encrypted tokens (JWE).
The token is decoded in this browser tab. It is not sent to a server. Read the privacy information.
How it works
The tool splits the token on dots, decodes the Base64url header and payload, parses them as JSON and prints them with readable dates for the standard time claims.
Real-world uses
- Debugging 401 and 403 errors
- Checking scopes, audience and expiry
- Understanding what a login system puts in its tokens
How to read a JWT, and what you must not conclude from it
A JWT has three parts separated by dots: a header, a payload and a signature. The header names the signing algorithm and sometimes a key ID. The payload contains the claims: who issued the token (iss), who it is about (sub), who it is meant for (aud), when it was issued (iat), when it becomes valid (nbf) and when it expires (exp), plus any application-specific data such as roles or scopes. This tool decodes the first two parts and presents the times in readable form.
Decoding is not verifying. Anyone can create a token that looks correct, so the contents prove nothing until a server checks the signature with the right key. This tool does not verify signatures. Use it to inspect and debug, not to decide that a token is trustworthy.
Treat tokens as secrets. A valid access token is a key to whatever it grants, until it expires. Pasting one into a website that processes it on a server hands it to a third party. Local decoding avoids that, but the token still appears on your screen and in your clipboard, so use test tokens where you can and never share live ones in a ticket or chat.
When debugging, compare the expiry with the current time first, since expired tokens are the most common cause of failures. Then check the audience and issuer against what the API expects, and the scopes or roles against what the endpoint needs. Clock differences between systems can make a freshly issued token look not yet valid; the nbf and iat times show whether that is the case.
Tips for better results
- Check exp first when a token is rejected.
- Use test tokens where possible.
- Verify signatures in your own server code, never by eye.
Frequently asked questions
Does this verify the signature?
No. It only decodes the header and payload. Signature verification needs the signing key and is done by the server or a library in your own code.
Is it safe to paste a real token here?
The decoding runs in your browser and the token is not sent to a server. Even so, a token is a credential, so prefer test tokens and avoid sharing live ones.
Why does it say my token is expired?
The exp claim is a time in the past according to your device clock. Request a new token. If you think it should still be valid, check your device’s date and time.
What if the token has only two parts?
Unsigned tokens have an empty signature section. The tool accepts two or three parts and decodes the header and payload.