How to use
- Paste a JWT into the box. A leading "Bearer " copied from an Authorization header is removed automatically.
- Read the decoded header (algorithm and token type) and the payload claims. Times such as exp, iat and nbf are shown as readable dates, with the time left before the token expires.
- Copy the header, the payload or the token. Remember that the signature is shown but not verified.
What is inside a JWT
A JSON Web Token (RFC 7519) has three parts separated by dots: a header, a payload and a signature. The header and payload are JSON encoded with Base64URL, so anyone who has the token can read them; decoding needs no key. The signature proves the token was issued by someone holding the key and has not been changed since.
That is also the main security rule: a JWT is signed, not encrypted. Never put passwords or other secrets in the payload.
Standard claims
The registered claims you will see most often:
| Claim | Meaning |
|---|---|
| iss | Issuer: who created the token |
| sub | Subject: usually the user ID |
| aud | Audience: which API or app should accept it |
| exp | Expiration time, in seconds since January 1, 1970 (UTC) |
| nbf | Not before: the token is not valid until this time |
| iat | Issued at: when the token was created |
| jti | A unique ID for the token, used to block replays |
Debugging with a decoder
Most "401 Unauthorized" problems come down to a few things you can see here: an exp in the past, a clock that is off so nbf is still in the future, the wrong aud for the API you are calling, or a token from a different environment (iss). Comparing the alg in the header with what your server expects catches configuration mistakes too.
Decoding is not verification. To trust a token, your server must check the signature with the secret or public key and reject unexpected algorithms such as none.
Frequently asked questions
Is it safe to paste a token here?
The token is decoded in your browser and never sent anywhere. Still treat live tokens like passwords: anyone who has one can use it until it expires.
Why does it say the signature is not verified?
Checking the signature needs the secret or public key, which only your server should have. This tool reads the token; it does not prove it is genuine.
How do I read the exp number?
It is a Unix timestamp in seconds. The decoder shows it as a date and the time left; the Unix Timestamp Converter does the same for any number.
Can it decode encrypted tokens (JWE)?
No. Encrypted tokens have five parts and need the decryption key. This tool reads signed tokens (JWS) with three parts.
