---
title: "JWT Decoder — Decode & Inspect JWT Tokens Online | fbuff"
description: "Paste a JWT token and instantly decode the header, payload and signature. View expiry time, issued at, and all claims. Token never leaves your browser."
url: https://fbuff.com/tools/jwt-decoder/
---

![Token split into three linked parts with a magnifying glass over the middle one](https://fbuff.com/content/jwt-decoder.webp)

## How to use

1. Paste a JWT into the box. A leading "Bearer " copied from an Authorization header is removed automatically.
2. Read the decoded header (algorithm and token type) and the payload claims. Times such as exp, iat and nbf are shown as readable dates, with the time left before the token expires.
3. Copy the header, the payload or the token. Remember that the signature is shown but not verified.

## What is inside a JWT

A JSON Web Token (RFC 7519) has three parts separated by dots: a header, a payload and a signature. The header and payload are JSON encoded with Base64URL, so anyone who has the token can read them; decoding needs no key. The signature proves the token was issued by someone holding the key and has not been changed since.

That is also the main security rule: a JWT is signed, not encrypted. Never put passwords or other secrets in the payload.

## Standard claims

The registered claims you will see most often:

| Claim | Meaning |
| --- | --- |
| iss | Issuer: who created the token |
| sub | Subject: usually the user ID |
| aud | Audience: which API or app should accept it |
| exp | Expiration time, in seconds since January 1, 1970 (UTC) |
| nbf | Not before: the token is not valid until this time |
| iat | Issued at: when the token was created |
| jti | A unique ID for the token, used to block replays |

## Debugging with a decoder

Most "401 Unauthorized" problems come down to a few things you can see here: an exp in the past, a clock that is off so nbf is still in the future, the wrong aud for the API you are calling, or a token from a different environment (iss). Comparing the alg in the header with what your server expects catches configuration mistakes too.

Decoding is not verification. To trust a token, your server must check the signature with the secret or public key and reject unexpected algorithms such as none.

## Frequently asked questions

### Is it safe to paste a token here?

The token is decoded in your browser and never sent anywhere. Still treat live tokens like passwords: anyone who has one can use it until it expires.

### Why does it say the signature is not verified?

Checking the signature needs the secret or public key, which only your server should have. This tool reads the token; it does not prove it is genuine.

### How do I read the exp number?

It is a Unix timestamp in seconds. The decoder shows it as a date and the time left; the Unix Timestamp Converter does the same for any number.

### Can it decode encrypted tokens (JWE)?

No. Encrypted tokens have five parts and need the decryption key. This tool reads signed tokens (JWS) with three parts.

Found a problem or have an idea? [Report a problem](https://fbuff.com/contact/?tool=jwt-decoder)

Share

## You might also like

- - [JSON Path Finder Inspect JSON, copy exact JSONPath expressions, and test paths locally.](https://fbuff.com/tools/json-path-finder/)
- - [URL Encoder Decoder Encode and decode URL components locally in your browser.](https://fbuff.com/tools/url-encoder-decoder/)
- - [Base64 Encoder Decoder Encode and decode Base64 text locally in your browser.](https://fbuff.com/tools/base64-encoder-decoder/)
- - [GUID / UUID Generator Generate UUIDs and convert GUIDs to short GUIDs locally in your browser.](https://fbuff.com/tools/guid-uuid-generator/)
- - [JSON Formatter Format, prettify and validate JSON instantly. Minify in one click.](https://fbuff.com/tools/json-formatter/)
- - [Cron Job Parser Parse full crontab lines with commands, explain the schedule, and preview the next 5 runs.](https://fbuff.com/tools/cron-parser/)
- - [HTML Previewer Write or paste HTML and preview it live in a sandboxed iframe. Supports full pages and fragments.](https://fbuff.com/tools/html-previewer/)
- - [Regex Tester & Extractor Test regular expressions in real time, inspect capture groups, and generate code snippets.](https://fbuff.com/tools/regex-tester/)
- - [Number Base Converter Instantly convert numbers between binary, octal, decimal, and hexadecimal. Supports large numbers. 100% client-side.](https://fbuff.com/tools/number-base/)
- - [Unix Timestamp Converter Convert Unix epoch to datetime and back. 100% client-side.](https://fbuff.com/tools/unix-timestamp/)