Paste a JWT token
About this JWT decoder
JWT stands for JSON Web Token. It is a compact string used to pass claims between systems, often after sign-in or when one service calls another. A normal signed JWT has three Base64URL pieces separated by dots: header.payload.signature.
The header is JSON and usually names the token type and signing algorithm, such as HS256 or RS256. The payload is also JSON. It can contain an account id, roles and standard claims: iss names the issuer, sub names the subject, aud names the intended service, iat records when the token was issued, nbf says when it starts working and exp says when it expires. The signature covers the encoded header and payload so a receiving service can detect changes.
This decoder opens the header and payload, formats their JSON and shows exp as a date. It does not decrypt the token because ordinary JWT payloads are encoded, not encrypted. Anyone holding the token can usually read those two parts.
Decoding is not verification. This page does not have the expected algorithm, issuer, audience or secret/public key needed to check the signature and claims. Do not treat the displayed data as trusted, and protect a real Bearer token because it may grant access even though its payload is readable. Everything is processed in this tab.
What the three pieces mean
The first two pieces are readable JSON encoded with Base64URL. The third piece must be verified with the issuer's key before the claims can be trusted.
| Piece | What you can learn |
|---|---|
| Header | Token type and signing algorithm, such as HS256 or RS256 |
| Payload | Claims such as sub, role, iat and exp |
| Signature | Lets the receiving service check that the token was not changed |
| exp | Time after which the service should reject the token |
How to decode a JWT token
- Paste the token: Paste all three pieces. You may include the word Bearer at the start.
- Read the JSON: The header and payload open automatically. If exp is present, its date appears above.
- Treat it as unverified: Reading a token does not prove who made it. Verify the signature in the system that issued it.
Frequently asked questions
Is the JWT uploaded or stored?
No. Your browser decodes it on this page. There is no account and no copy on our server. Still, do not send a real access token to other people.
Does this decoder verify the JWT signature?
No. It only reads the token. Proper verification needs the allowed algorithm, the correct secret or public key, and checks for claims such as issuer, audience, exp and nbf. Those rules come from the service that issued the token.
Is the JWT payload encrypted or secret?
Usually no. The header and payload are Base64URL text that anyone holding the token can read. Do not put passwords or other secrets in a JWT payload.
What does exp mean in a JWT?
exp is the expiration time in seconds since 1 January 1970. iat records when the token was issued, while nbf can say when it begins to work. This page displays exp as a date, but the receiving service still decides whether to accept the token.