JWT Decoder
Paste a JSON Web Token to read its header and payload with human-readable timestamps. Decoding is local and the signature is not verified.
What is inside a JWT
A JSON Web Token is three Base64url-encoded segments separated by dots. The
header names the signing algorithm (such as HS256 or RS256) and the token
type. The payload holds the claims: standard ones like sub (the
subject the token is about), iss (issuer), aud (audience) and the
timestamp claims, plus any custom fields the issuer adds. The signature is a
hash of the first two parts made with a secret or private key - it is what proves the token was
not altered.
The timestamp claims
Three claims are Unix timestamps in seconds and this tool converts each to your local time.
iat records when the token was issued, nbf marks the earliest moment
it may be used, and exp is when it expires. The table shows whether the token is
currently within its valid window and how long until - or since - it expires, so you can tell
at a glance whether an auth failure is simply a stale token.
Decoding is not verifying
This is the point worth repeating: reading a JWT and trusting it are different things. Because the payload is only encoded, not encrypted, anyone can see and decode its contents - which is exactly what happens here. Only checking the signature against the issuer's key proves the token is genuine, and that must happen on a server that holds the key. Treat this tool as a window for debugging, never as an authorisation check.
Since each JWT segment is Base64url and each decoded segment is JSON, the
Base64 encoder and the
JSON formatter are natural companions. To convert a raw
exp value by hand, the Unix timestamp converter
does the epoch-to-date maths.