JWT Decoder

About JWT Decoder

A JSON Web Token is three base64url segments joined by dots: a header, a payload of claims, and a signature. This decoder splits a token you paste, prints the header and payload as formatted JSON, translates exp and iat into readable dates, and keeps a live expired-or-valid badge. It reads the token only; it never checks the signature.

How to use it

1. Paste the whole token into the box labeled JWT Token. Leading and trailing whitespace is trimmed.
2. Look at the badges above the results for the signing algorithm, the number of claims, the token's age, and Valid or Expired.
3. Read the Header and Payload sections. Chips show Expires, Issued and Subject when those claims are present.
4. Use Copy JSON on either section, Copy token for the whole string, or Copy under the raw Signature.

A short HS256 token

A token whose header is {"alg":"HS256","typ":"JWT"} and whose payload is {"sub":"42","exp":1893456000}, signed with HS256 (paste the three dot-separated parts of any such token).

Header {"alg":"HS256","typ":"JWT"}, payload {"sub":"42","exp":1893456000}. The exp value is midnight UTC on 1 January 2030 and is shown in your local time zone; the badge reads Valid until then.

When to use it

• Checking which scopes and audience an access token actually carries while debugging an authorization error.
• Finding out whether a 401 came from an expired token by reading the exp claim.
• Confirming that a token issuer put the user identifier in sub rather than a custom claim.
• Comparing the header alg value against what your API is configured to accept.

Questions about JWT Decoder

Does the Valid badge mean the token is authentic?

No. Valid only means the exp claim is still in the future, and it is re-evaluated every second. Nothing here tests the signature, so a forged token with a future exp would also show Valid.

Why does the page say the signature cannot be verified?

Verifying needs the shared secret for HMAC tokens or the issuer's public key for RSA and ECDSA tokens. If you have an HS256, HS384 or HS512 secret, the JWT verifier tool can test it.

Is a JWT payload secret?

No. Base64url is an encoding, not encryption, so anyone holding the token can read its claims. Do not put passwords or private data in one unless the token is an encrypted JWE, which this tool cannot open.

Are accented letters and non-Latin claims shown correctly?

Yes. Each segment is converted from base64url to bytes and then read as UTF-8, so a claim such as Zoë 日本 or an emoji appears exactly as the issuer wrote it. Only a segment that is not valid UTF-8 JSON shows an error.

What does invalid JWT format mean?

The pasted text did not split into exactly three dot-separated parts. Common causes are a stray Bearer prefix, a truncated copy, or a five-part encrypted token.

Related tools

• JWT verifierVerify a JWT's HMAC signature against a secret and validate its time claims.
• Base32 encoder and decoderEncode text to Base32 or decode Base32 back to text following RFC 4648, with optional padding and the Base32hex alphabet.
• MD5 GeneratorGenerate an MD5 hash from text
• SHA GeneratorGenerate SHA-1, SHA-256, SHA-384, and SHA-512 hashes
• Bcrypt GeneratorGenerate a bcrypt hash from text
• Whirlpool GeneratorGenerate a Whirlpool hash from text