Skip to content

JWT decoder

Read the header and payload of a JSON Web Token, with issue and expiry times turned into dates.

Favorite
Runs in your browser. Nothing you paste is sent anywhere.

Header


		

			
Signature

			
 Not checked Checking it needs the secret key, which should never be pasted into a website.

		

	

	

		
Payload

		

		
	



		


		
		

			

				
How it works

				header . payload . signature
			

			
A JWT is three Base64url pieces joined by dots. The first two are plain JSON that anyone can read; only the signature proves the token wasn’t changed. Your token, colored by part:

							

						
    
									
  1. 
						Split at the dots
						3 parts → header, payload, signature
					
    2. 
									
  2. 
						Base64url-decode the first two
						- → +, _ → /, add = padding, then decode to JSON
					
    3. 
									
  3. 
						Turn time claims into dates
						exp, iat, nbf are seconds since 1 Jan 1970 (Unix time)
					
    4. 
							

		


		
										

				
Registered claims

				

					

						
							

																	Claim
																	Meaning
															

						
						
															

																			iss
																			issuer: who made the token
																	

															

																			sub
																			subject: who it’s about (a user ID)
																	

															

																			aud
																			audience: who should accept it
																	

															

																			exp
																			expires at (Unix time)
																	

															

																			nbf
																			not valid before (Unix time)
																	

															

																			iat
																			issued at (Unix time)
																	

															

																			jti
																			token ID, to stop replays
																	

													
					

				

							

		
							

				
Good to know

				
    
											
  • The payload isn’t secret: never put passwords or personal data in a JWT.
    • 
											
  • Login tokens from real sites are keys to an account: decoding here is safe because nothing leaves your browser, but don’t paste them into tools you don’t trust.
    •