The algorithm, key ID, subject, issuer, audience, and every custom claim are shown as formatted JSON you can copy or download.
Developer
JWT Decoder
Paste a JSON Web Token to read its header and claims, and see at a glance whether it has expired. Your token never leaves this page.
TokenPaste a JWT, with or without Bearer
DecodedHeader and payload
Nothing decoded yet
Paste a JSON Web Token to read its header, its claims, and when it expires.
What it handles
See inside a token without sending it anywhere.
A JWT is three Base64URL parts joined by dots. The first two are plain JSON, so anyone can read them, which is what makes debugging authentication problems possible.
The iat, nbf, and exp claims are converted to real dates, with a plain statement such as Expires in 2 hours or Expired 3 days ago.
Decoding is not verification. This tool shows what a token says, not whether it is genuine, and warns about unsigned tokens.
Frequently asked questions
Does this verify the signature?
No. Verifying needs the secret or public key, and this tool never asks for one. Decoding only reveals the contents, which are readable by anyone who has the token.
Is it safe to paste a real token here?
The token is decoded in your browser and is not uploaded. Even so, treat a live token like a password: prefer expired or test tokens, and never share one publicly.
What do iat, nbf, and exp mean?
iat is when the token was issued, nbf is the earliest time it is valid, and exp is when it expires. They are counted in seconds since 1 January 1970 UTC.
Why can't it read my token?
A JWT has exactly three dot-separated parts. Five parts means an encrypted token (JWE), which cannot be read without its key, and anything else is probably not a JWT.