JWT decoder
Paste a JSON Web Token and read what is inside it.
This tool needs JavaScript. Please turn it on in your browser.
How to use it
Step 1
Paste the token. It has three parts separated by dots.
Step 2
Read the header and the payload as formatted JSON.
Step 3
Check the exp, iat and nbf times, shown as dates, and whether the token has expired.
About this tool
A JWT is a signed token that apps use after login. The first two parts are just Base64URL-encoded JSON, so anyone can read them: do not put secrets in a JWT.
This tool only decodes. It does NOT check the signature, so a decoded token is not proof that it is genuine. Verify tokens on your server with the right key. Decoding happens in your browser and the token is not sent to us.
Questions
Does it verify the signature?
No. It only decodes the header and payload. Signature checks need the secret or public key and must be done on your server.
Is it safe to paste a real token?
The token stays in your browser. Even so, treat live tokens like passwords: use an expired or test token when you can.
Why does it say expired?
The exp claim is a Unix time. If it is earlier than the current time of your device, the token has expired.
Which algorithms are supported?
The decoder does not care: it reads the first two parts of any JWT, whatever algorithm signed it.