JWT Decoder

What is a JWT?

A JSON Web Token (JWT) is a compact way to pass information such as a user ID and permissions between a login server and an application. It looks like a long string of letters made of three parts separated by dots: a header, a payload and a signature. The header and payload are JSON objects encoded with URL-safe Base64, so anyone can read them. The signature is what proves the token was issued by someone who holds the secret or private key.

How to decode a JWT

1. Paste the token into the box. A leading Bearer prefix is removed automatically.
2. The header and payload appear as formatted JSON straight away.
3. Check the time claims table for when the token was issued and when it expires.
4. Read the status message to see whether the token is expired, not yet valid or within its valid time.
5. Copy the header, the payload or both as JSON.

What the decoder shows

• Header with the signing algorithm (alg), token type and key ID.
• Payload with all claims, decoded as UTF-8 so names in any language display correctly.
• Time claims iat, nbf and exp as local time, UTC and relative time such as “in 2 hours”.
• Summary of the issuer, subject and audience.
• Warnings for unsigned tokens that use alg: none and for encrypted tokens that cannot be read.

Decoding is not verifying

This tool does not check the signature. A decoded token may look perfectly valid even if someone changed the payload, because changing it is as easy as editing Base64. Only your server, using the correct secret or public key, can verify a token. Never make security decisions in an application based on a token that has merely been decoded.

Common reasons to decode a token

Developers decode tokens to debug login problems, for example to see whether a user is missing a role or whether the token expired earlier than expected. Support engineers check which account a token belongs to. Testers confirm that the audience and issuer are correct for each environment. When a request fails with an authorisation error, the expiry time is the first thing to check, and clock differences between servers are a common cause.

Is it safe to paste a token here?

The token is decoded in your browser and never sent to our server. Even so, treat live tokens like passwords. Prefer tokens from test environments, and remember that a token remains usable by anyone who has it until it expires.