JWT Decoder

This JWT decoder splits a JSON Web Token into its header, payload and signature and shows the first two as formatted JSON. A token looks like a random string, but its header and payload are only Base64url-encoded JSON, so anyone holding the token can read them. You can check its claims here without a secret key, and the decoding runs in your browser.

How to decode a JWT token

1. Paste the token into the Paste JWT Token box. If you copied it from an Authorization header, leave out the word Bearer and the space after it, because the token fails to decode with them.
2. The decoder runs on its own a moment after you stop typing, once the text has three dot-separated parts. Decode JWT runs it on demand, and Paste Example loads a sample token.
3. Read the colour-coded token, then the Header (JOSE) and Payload (Claims) panels. Copy Header and Copy Payload copy the formatted JSON.
4. Check Token Timing, where iat, nbf and exp appear as dates in your local time with a relative time such as "in 3 hours".
5. The Signature panel shows the third part as hex bytes.

Example: decoding a JWT

This HS256 token was signed with the secret demo-secret:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyXzg4MTIiLCJzY29wZSI6InJlYWQ6b3JkZXJzIiwiaWF0IjoxNzkzOTU1NjAwLCJleHAiOjE3OTM5NTkyMDB9.5lS_RbfAdQt9zLSPGjW256tDu2TqM50YbLpsKFhn5Pw

The three parts are separated by dots. The header and payload both start with eyJ, which is how {" followed by a letter looks in Base64url, so most tokens you meet begin the same way. A JWT decode of this one gives:

{
  "alg": "HS256",
  "typ": "JWT"
}

{
  "sub": "user_8812",
  "scope": "read:orders",
  "iat": 1793955600,
  "exp": 1793959200
}

Token Timing shows Issued At as Friday 6 November 2026, 09:00:00 UTC (displayed in your own time zone) and Expires At one hour later. Until 10:00 UTC that day the status line reads Token is VALID; after it, Token is EXPIRED. The signature panel shows e654bf45b7c0750b7dccb48f1a35b6e7ab43bb64ea339d186cba6c285867e4fc, the HMAC-SHA256 of the first two parts, which you can reproduce in the hash generator with the same key.

JSON web token claims

RFC 7519 registers seven claim names. All are optional, and issuers add their own, such as scope, email or role.

Copy Payload and paste the claims into the JSON formatter if you want to browse a large payload as a tree. The three time claims are NumericDate values: seconds since 1 January 1970 UTC. To turn one into a date by hand, or to build a test value, use the Unix timestamp converter.

Debugging auth flows

When my login flow isn't working, the first thing I do is paste the token into this JWT decoder. I check the exp (expiration) and scope claims to make sure the token has the permissions it needs. The green "Token is VALID" line only means exp is still in the future; it does not check nbf or the signature. A token without exp gets a note that no expiration claim was found.

What the JWT decoder does not do

• It does not verify signatures, so a decoded token is not proof that the token is genuine.
• It does not create or encode tokens, and it cannot edit a claim and re-sign the token. Any change to the payload makes the original signature invalid.
• It shows iss, aud and nbf but does not compare them with anything, so it cannot tell you whether a given service will accept the token.
• It reads signed tokens with three parts only. An encrypted JWE token has five parts and is rejected with an error saying a token must have three.

Client-side security

Never paste a production token into a site that sends data to a server. This decoder runs in your browser with JavaScript and makes no network request, so your tokens stay on your machine. How to decode JWT safely explains the risks in more detail, and the other encoders and decoders are under developer tools.