Paste
Use the token alone or include the Bearer or Authorization prefix.
Decodes in your browser · Nothing is uploaded
Read a JWT without the guesswork.
Paste a token to see its header, payload, time status, and claims in plain language. No account, secret key, or JWT experience required.
Step 1
Paste your token
A raw JWT, Bearer …, or a copied Authorization: header all work.
Processing stays on this device. Still avoid real production tokens when possible.
Decode
We split and read the token locally in your browser.
Check
Review time status, claims, and the unverified-signature warning.
JWT basics
What you are looking at
A JSON Web Token is a compact way to carry claims between systems. A signed JWT usually has three Base64URL-encoded parts separated by dots.
01
Header
Metadata such as typ (token type), alg (signing algorithm), and sometimes kid (key ID).
02
Payload
Claims about a subject, such as a user ID, issuer, audience, role, and time limits.
03
Signature
Cryptographic proof checked by the receiver. It is not encryption and this decoder does not verify it.
Decode for insight. Verify for trust.
Decoding only changes the representation from Base64URL to readable JSON. It does not prove who created the token, whether it was changed, or whether your API should accept it.
Production validation should also check the expected algorithm, signature, issuer, audience, expiration, and not-before time in a maintained JWT library.
Common claim reference
Claim names are short because JWTs are designed to stay compact.
issIssuer
Who created and issued this token.
subSubject
Who or what this token identifies.
audAudience
The API or app this token is intended for.
expExpires at
When the token must stop being accepted.
nbfNot before
The earliest time the token may be accepted.
iatIssued at
When the issuer created the token.
jtiToken ID
A unique identifier that can help prevent replay.
Questions, answered
The important details
A few short answers before you use decoded token data in real work.
Is a JWT encrypted?
Usually, no. A common three-part signed JWT is encoded and readable by anyone who has it. Encrypted JWTs use JWE and normally have five parts; this tool focuses on three-part signed JWTs.
Does a readable token mean it is valid?
No. A forged or edited token can still decode perfectly. The receiving application must verify the signature and validate the expected issuer, audience, algorithm, and time claims.
Why does my token say expired?
The exp claim is a Unix timestamp in seconds. If it is earlier than the current device time, the token is expired. Small clock differences can matter, so also check the server clock.
Can I paste a real access token here?
Decoding happens locally, but access tokens are credentials. Prefer a redacted or test token, avoid screenshots or shared links, and never send a live token to someone else.
Decoded claims are readable, not trusted. Follow the JWT decoding-versus-verification guide before accepting an algorithm, issuer, audience, signature, or time-based claim.