JWT Decoder
Read a token’s header, claims, and expiration time without sending it anywhere. Decode locally to understand an authentication problem.
Paste the token alone or with its Bearer prefix. Maximum 65,536 characters. No token is saved in the page address or browser storage.
What decoding can tell you
Header describes the token format. Payload contains claims such as its subject or expiry. Anyone can create these fields: decoding does not prove who issued a token, verify its signature, or decide whether a server will accept it. Encrypted five-part tokens (JWE) are not supported.
Duplicate JSON keys and numbers that cannot be represented safely are rejected. Other server validation rules, expected issuer, audience, and clock tolerance still need to be checked by your application.
Decoded token
Signature not verified. These are readable claims, not proof that a token is authentic.
Paste a token or try the fictional example.
Time claims
- Decode a token to inspect its time claims.
UTC times use this device’s clock at the moment you decode. Decode again to refresh; time claims alone never establish validity.
Ready. Paste a token or use the example, then decode.
FOLLOW THE CLAIMS
Readable.
Still unverified.
Find an expiration problem
exp is expiration, nbf is the earliest permitted use, and iat is the claimed issue time. Values are seconds since the Unix epoch. An expired claim can explain a rejected request; a future expiration does not prove that a token is accepted.
Keep the original private
Decoding stays in memory. Clear removes the pasted token and results. Copy and download are explicit actions that include decoded claims, which may still be sensitive. No secret or private key is requested.
Format reference: JSON Web Token, RFC 7519.