JWT decoder: read the token behind the request
A JSON Web Token (JWT) carries claims between systems. When an API returns an authentication error, decoding the token can help you inspect the intended audience, identify the subject or read the expiration time. This online JWT decoder separates the header, payload and signature so you can inspect each part without installing a command-line tool.
A typical signed JWT uses the compact form header.payload.signature. The first two segments contain Base64url-encoded JSON. The third contains signature or MAC bytes, not another JSON document. Base64url changes how data is represented; it does not conceal it. Anyone who has a signed token can generally read its claims.
How to decode a JWT online
- Paste your compact token into the encoded-token field. A Bearer or Authorization: Bearer prefix is accepted.
- Read the header for metadata such as
alg,typandkid. These are declarations from the input, not independently verified facts. - Inspect the payload and use the time table to convert
iat,nbfandexpinto UTC dates. - Copy either JSON panel for debugging. Verify the original token in your application before using its claims to make access decisions.
Decoding happens as you type or paste. Invalid input replaces the decoded panels with a format error, so an earlier result cannot be mistaken for the current token. JSON number spelling is preserved in the displayed and copied content, including large numeric identifiers.
Common JWT claims and what to check
| Claim | Meaning and debugging question |
|---|---|
| iss | Issuer. Did the expected identity provider issue this token? |
| sub | Subject. Which user or other entity does the token describe? |
| aud | Audience. Is your API an intended recipient? This can be a string or an array of strings. |
| exp | Expiration time. Has the point after which the token must not be accepted been reached? |
| nbf | Not-before time. Is the token being used before its permitted start time? |
| iat | Issued-at time. When does the token say it was issued? |
| jti | Token identifier. A unique identifier that an application may use in replay prevention. |
Registered claims are not all universally required; the application or protocol defines which ones must be present. Custom claims such as roles or scope also depend on the service. A decoder cannot determine the authorization policy that should apply to them.
JWT time claims use seconds since 1970-01-01T00:00:00Z. For example, 1704067200 is 2024-01-01 at 00:00 UTC. A JavaScript millisecond timestamp pasted into a seconds field produces a very different date. The comparison here uses your device clock and no tolerance; production validators may allow a small, explicitly configured amount of clock skew.
Three examples to explore
Expired sample
HS256 · time claims
The example has exp set to 2024-01-01 at 01:00 UTC. Inspect the dates and the expiration comparison. Its signature is only a placeholder.
Unsigned token
alg: none · empty signature
See why a token can have readable claims and no signature at all. The final dot remains part of its three-part representation.
Unicode claims
UTF-8 · multiple audiences
Read a name with Chinese and accented characters, a Japanese message and an audience array. Its RS256 signature is also a placeholder.
Load these fixtures with the example buttons above the results. They contain fictional data and are not working authentication credentials.
Decoding a JWT is not signature verification
Decoding answers “What does this token say?” Verification helps answer “Was this token produced by a trusted party, and is it acceptable here?” An attacker can edit JSON claims and encode a new token. A decoder will still be able to read it, even when its signature is missing, fabricated or no longer matches the contents.
Use a maintained JWT library on the receiving side. Configure the allowed algorithms and trusted keys independently of the incoming token, verify its cryptographic protection and enforce the issuer, audience, time and other claims required by your application. Do not choose trust settings solely from the token’s own alg or key references.
This tool shows the declared algorithm and the signature’s decoded byte length. It does not accept secrets, load public keys, follow key URLs or issue an overall “valid token” verdict. A time comparison is only a debugging aid. An apparently unexpired token can still have a forged signature or the wrong audience.
For the underlying standards, see RFC 7519: JSON Web Token, RFC 7515: JSON Web Signature and RFC 8725: JWT Best Current Practices.
JWT decode: frequently asked questions
Can I decode a JWT without a secret?
Yes. For a three-part JWT, the header and payload are Base64url-encoded JSON and can be read without a secret or public key. A key is needed for cryptographic verification, not for decoding. Encrypted five-part JWE tokens are different and cannot be decrypted by this tool.
Does this JWT decoder verify the signature?
No. It displays the signature bytes and the algorithm declared in the header, but performs no cryptographic verification. A readable payload, a recognized algorithm or a future expiration time does not prove that a token is authentic.
Is my JWT sent to a server?
The decoder runs in your browser. Its input is not submitted to a decoding API, stored by the tool or added to the page URL. The examples use fictional claims. Prefer sample tokens when exploring the tool, since a live bearer token can grant access to an account or service.
How do I check the JWT expiration time?
Look for exp in the payload and the Expires at row in the time table. exp is a NumericDate: seconds since the Unix epoch, not milliseconds. The table shows UTC and compares the value with your device clock, without clock-skew allowance. Your application still needs to verify the token and apply its own validation rules.
Why does my token fail to decode?
Check that you pasted the complete compact token with three dot-separated parts. Header and payload must be unpadded Base64url containing UTF-8 JSON objects. This decoder rejects malformed encoding, duplicate JSON keys and inconsistent empty signatures. A five-part token is usually an encrypted JWE, which this tool does not decrypt.
Can I paste an Authorization: Bearer header?
Yes. Paste the token alone, Bearer followed by the token, or Authorization: Bearer followed by the token. The prefix is removed locally. Do not paste a complete HTTP request or insert whitespace inside the compact token.
What does alg: none mean?
It identifies an unsecured JWT with no cryptographic signature. Its compact representation still has three parts, but the final part is empty and the token ends in a dot. Reading such a token does not make its claims trustworthy.
Can this tool decode nested or encrypted JWTs?
It supports a three-part compact JWT whose header and payload are JSON objects. It does not decrypt JWE, recursively process nested tokens, evaluate critical extensions or support unencoded JWS payloads. Input is limited to 50,000 characters and JSON nesting to 64 levels.