JWT Decoder

Decode a JWT’s header, payload, and expiry instantly.

Your token is decoded here and never sent

Decode a JWT token online

JWT token

About this JWT decoder

Paste a JSON Web Token and see its header and payload as formatted JSON, plus a breakdown of the registered claims: issuer, subject, audience, and the exp, iat, and nbf timestamps translated into readable local dates with relative times. A VALID / EXPIRED badge tells you at a glance whether the token is past its expiry — the most common reason an API suddenly starts returning 401 errors.

Tokens often carry user IDs, emails, and roles, and a leaked token can be replayed against the API that issued it. That’s why this decoder runs entirely in your browser: nothing is sent to a server, logged, or stored, unlike online decoders that process tokens remotely. Note that it decodes but does not verify — checking the signature requires the issuer’s secret or public key, which should never be pasted into a website.

What each claim and header field means

The header carries metadata about how the token is signed; the payload carries the claims — the statements about the user or session. RFC 7519 section 4.1 registers seven claim names; the header fields come from the JWS spec (RFC 7515). This decoder shows all of them, but only reads them — it never checks the signature.

Field	Part	Meaning
iss	Payload	Issuer — who created and signed the token.
sub	Payload	Subject — the principal the token is about, usually a user ID.
aud	Payload	Audience — the recipient(s) the token is intended for.
exp	Payload	Expiration time (Unix seconds); on or after this, the token MUST NOT be accepted.
nbf	Payload	Not before (Unix seconds); before this, the token MUST NOT be accepted.
iat	Payload	Issued at (Unix seconds) — when the token was created.
jti	Payload	JWT ID — a unique identifier, useful to prevent replay.
alg	Header	Signing algorithm, e.g. HS256 or RS256; must be present.
typ	Header	Media type of the token, typically "JWT".
kid	Header	Key ID — a hint telling the server which key verifies this token.

Why was my token rejected?

When a token works everywhere but one endpoint, decoding it usually reveals a claim the server disagrees with. This tool shows a VALID / EXPIRED badge from exp, but the server checks more than expiry. The common causes:

Condition in the token	What happens
exp is in the past	Rejected as expired — the usual 401 after a token sits idle too long.
nbf is in the future (or client and server clocks differ)	Rejected as not yet valid; a few minutes of clock skew is a frequent culprit.
aud does not match the API	Rejected as wrong audience — the token was minted for a different service.
iss is not an issuer the server trusts	Rejected as wrong issuer.
alg is none, or an alg the server does not expect	Must be rejected: alg:none means "unsigned", and accepting it (or letting a token choose its own algorithm) lets an attacker forge tokens. A correct server pins the algorithm it will accept.

Because this tool only decodes, a VALID badge here does not mean the server will accept the token — only the signature check on the server proves that.

FAQ

Is it safe to paste a real JWT here?

Yes — decoding runs entirely in your browser with JavaScript; the token is never uploaded, logged, or stored anywhere. That’s the difference from decoders that send tokens to a server. Even so, treat live production tokens like passwords and rotate any you believe was exposed.

What is the difference between decoding and verifying a JWT?

Decoding just reads the Base64URL-encoded header and payload — anyone can do it, no key required. Verifying checks the cryptographic signature against the issuer’s secret (HS256) or public key (RS256/ES256) to prove the token wasn’t tampered with. This tool decodes only; verification belongs on your server.

What does the exp claim mean?

exp is the expiration time as a Unix timestamp (seconds since 1970). After that moment APIs must reject the token, which is why an expired token produces 401 responses. The VALID / EXPIRED badge compares exp against your device clock, so it’s as accurate as your local time.