About the JWT Decoder
Paste a JSON Web Token to see its header and payload. Timestamps such as exp, iat and nbf are converted to readable dates, and the token's expiry status is shown. Decoding happens locally.
Key features
- Decodes JWT header and payload instantly
- Converts exp, iat and nbf timestamps to readable dates
- Shows whether the token has expired
- Accepts tokens with a 'Bearer ' prefix
- Decoding happens locally; tokens are never uploaded
- Copy header or payload as formatted JSON
What is a JWT?
A JSON Web Token (JWT) is a compact, URL-safe token used for authentication and authorization by OAuth 2.0, OpenID Connect, Auth0, Firebase, Azure AD/Entra ID, Cognito, Supabase and countless APIs. It has three Base64URL-encoded parts separated by dots:
header.payload.signature
eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjMifQ.dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk
- Header: the algorithm and token type, e.g.
{"alg":"HS256","typ":"JWT"}. - Payload: the claims, i.e. data about the user and the token.
- Signature: proves the token wasn't modified; verified with a secret or public key.
Registered claims
| Claim | Name | Meaning |
|---|---|---|
iss | Issuer | Who issued the token |
sub | Subject | Who the token is about (user ID) |
aud | Audience | Who the token is intended for |
exp | Expiration | Unix time after which it's invalid |
nbf | Not before | Unix time before which it's invalid |
iat | Issued at | When it was created |
jti | JWT ID | Unique identifier, used to prevent replay |
The decoder converts exp, iat and nbf from Unix seconds into your local date and time and shows a Valid / Expired badge.
Debugging authentication with the decoder
- 401 Unauthorized? Check
exp; the token may have expired. - Wrong API? Compare
audwith the API's expected audience. - Missing permissions? Look for
scope,scp,rolesorpermissionsclaims. - Clock skew? If
nbforiatis in the future, server clocks may be out of sync. - Wrong tenant or issuer? Check
iss.
Signing algorithms
| Algorithm | Type | Verified with |
|---|---|---|
| HS256 / HS384 / HS512 | HMAC (shared secret) | The same secret |
| RS256 / PS256 | RSA | Issuer's public key (often via JWKS) |
| ES256 | ECDSA | Issuer's public key |
none | Unsigned | Should always be rejected |
Security reminders
- Decoding is not verification. Always verify signatures server-side with a trusted library.
- Don't store sensitive data in the payload; it's readable by anyone holding the token.
- Keep access tokens short-lived and use refresh tokens for long sessions.
Related tools
Decode other Base64 data with Base64 to JSON, or format the payload with the JSON Formatter.
How to use the JWT Decoder
- Paste your data into the input box, upload a file, or click Sample to try it out.
- Adjust the options above the editor if you need to (indentation, delimiter, and so on).
- The result appears instantly in the output panel. Any errors are shown with their line and column.
- Click Copy to copy the result, or Download to save it as a file.