About this JWT decoder
A JSON Web Token (JWT) carries claims about a user between systems, typically after sign-in. It has three parts separated by dots: a header naming the signing algorithm, a payload with the claims, and a signature. The first two parts are only Base64URL-encoded, not encrypted, so anyone holding the token can read them, which is exactly what this decoder does. It explains the standard claims, turns exp, iat, and nbf timestamps into readable dates, and tells you whether the token is still active. It does not verify the signature; that needs the issuer’s secret or public key and should be done by your server.
How to decode a JWT
- Paste the token. Copy it from an Authorization header, a cookie, or your browser’s developer tools, or press an example.
- Press Decode JWT. Read the status line to see if the token is active or expired, and check the color-coded structure.
- Inspect the claims. Copy the header, payload, or signature, and read the claims table for what each value means and when dates fall.
Frequently asked questions
Is it safe to paste a token here?
Decoding runs entirely in your browser and nothing is uploaded. Still, a valid token works like a password until it expires, so avoid sharing live production tokens anywhere you do not control.
Does decoding verify the token?
No. Decoding only reads the contents. Verifying checks the signature with the secret or public key to prove the token was not changed, and your server must always do that before trusting it.
Why can anyone read a JWT payload?
Signed tokens are encoded, not encrypted. Base64URL only makes the JSON safe to put in a URL or header, so never put passwords or other secrets in a JWT payload.
What do exp, iat, and nbf mean?
They are timestamps in seconds since 1 January 1970 (UTC). exp is when the token expires, iat when it was issued, and nbf the time before which it must not be accepted.
What is the difference between HS256 and RS256?
HS256 signs with one shared secret that both the issuer and the checker know. RS256 signs with a private key and is checked with a public key, so many services can verify tokens without being able to create them.