What is inside a JWT?
A JSON Web Token (RFC 7519) is three Base64URL-encoded parts joined by dots: header.payload.signature. The header names the signing algorithm (for example HS256 or RS256). The payload holds the claims — who the token is about (sub), who issued it (iss), when it expires (exp) and any custom data. The signature lets the server confirm that nobody changed the header or payload.
The header and payload are only encoded, not encrypted, so anyone holding the token can read them. That is exactly what this decoder does — useful for debugging authentication, checking which scopes or roles a token carries, or finding out why a request returns 401 Unauthorized.
How to decode a JWT
- Paste the token (with or without the
Bearerprefix). - Read the header, payload and registered claims.
exp,iatandnbfare converted from Unix seconds to readable UTC dates. - Use the Text tab to copy the decoded JSON.
Registered claims
| Claim | Meaning |
|---|---|
iss | Issuer – the service that created the token |
sub | Subject – usually the user ID |
aud | Audience – the API the token is meant for |
exp | Expiration time (Unix seconds) |
nbf | Not valid before (Unix seconds) |
iat | Issued at (Unix seconds) |
jti | Unique token ID |
Security notes
- Never put passwords or secrets in a JWT payload — anyone can decode it.
- Decoding is not validation. Your server must verify the signature with the secret or public key, and check
exp,audandiss. - Treat production tokens like passwords. This page decodes locally, but avoid pasting live tokens into any website you do not trust.
Frequently asked questions
Does this tool verify the signature?
No. Verifying needs the secret (HS256) or public key (RS256/ES256), which should stay on your server. The tool shows the signature segment but does not check it.
Can it decode encrypted tokens (JWE)?
No. A JWE has five parts and its payload is encrypted; it cannot be read without the key.
Why does it say the token is expired?
The exp claim is earlier than your device’s current time. Check your clock if this looks wrong.
Is the token sent anywhere?
No. Decoding happens in your browser and the token is never transmitted.