Skip to main content

JWT Decoder

English

Decode JSON Web Token and see the header and payload.

All calculations performed locally in your browser. No data sent to server.

Results are for informational purposes. Verify results with other sources.

Reading a JSON Web Token

A JWT is three Base64url segments joined by dots: a header saying how it was signed, a payload of claims, and a signature over the first two. Decoding shows you what a token asserts. It does not tell you whether those assertions are true.

How it works

  • Splits the token on its two dots into header, payload and signature.
  • Base64url-decodes the first two segments back into JSON and formats them for reading.
  • Renders the standard time claims — exp, iat, nbf — as human dates, since they are stored as Unix seconds.
  • Leaves the signature untouched: verifying it needs the issuer's secret or public key, which you should never paste into a web page.
token   = base64url(header) . base64url(payload) . base64url(signature)
signed  = HMAC or RSA/ECDSA over the first two segments
exp/iat = seconds since 1970-01-01T00:00:00Z (not milliseconds)

Worked example

The header of almost every HS256 token in existence, decoded by hand.

  1. header JSON: {"alg":"HS256","typ":"JWT"}
  2. Base64-encode it: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9
  3. note the trailing = padding is stripped — JWT always omits it
  4. a payload of {"sub":"1234567890","iat":1516239022}
  5. 1516239022 seconds → 2018-01-18T01:30:22Z

The decoded token says it was signed with HMAC-SHA256, concerns subject 1234567890, and was issued on 18 January 2018. Whether it is genuine is a separate question the signature answers.

Reading the result

  • Decoding is not verifying. A token whose payload says admin: true proves nothing until the signature checks out against a key you trust. Never make an authorisation decision on a decoded payload alone.
  • Do not paste production tokens into online decoders. This one runs entirely in your browser and sends nothing anywhere, but that is not true of every such site, and a bearer token is a password.
  • The payload is only encoded, not encrypted. Anyone holding the token can read every claim in it, so never put a secret in one.
  • Check exp against the current time and reject anything expired. Also check iss and aud — a valid signature from the wrong issuer is still the wrong token.
  • alg: none is a real value and a real attack. A verifier that trusts the header's algorithm choice can be told not to verify at all.

Common questions

Can this tool tell me if my token is valid?
No, and neither can any decoder without your key. It shows what the token claims. Validity means the signature matches, the token has not expired, and the issuer and audience are the ones you expect — checks that belong in your server, using a library.
Is it safe to paste my token here?
This page decodes in your browser and transmits nothing. Even so, the safe habit is to use tokens from a test environment. Treat any token that grants real access the way you would treat a password.
Why does my exp date come out in 1970?
You are almost certainly passing milliseconds where the spec requires seconds. JavaScript's Date.now() returns milliseconds; divide by 1000 before putting it in a claim.

Sources