Skip to content
Utilgrove

JWT Decoder

Decode a JSON Web Token to see its header, payload and expiry time, without sending it anywhere. Highlights expired tokens and standard claims.

How to use the decoder

Paste a token. The three parts are split and decoded instantly:

  • Header — the algorithm (alg) and type.
  • Payload — the claims: who the token is for, when it expires, and any custom data.
  • Signature — shown as-is; not verified (see the FAQ).

Timestamps (exp, iat, nbf) are converted to readable dates and the token is marked expired or valid. Click Load sample to see an example.

Anatomy of a JWT

A JSON Web Token is three Base64URL strings joined with dots:

eyJhbGciOiJIUzI1NiJ9 . eyJzdWIiOiIxMjMifQ . SflKxwRJSMe…
      header                payload           signature

The header and payload are plain JSON. The signature is computed over header.payload with the algorithm named in the header — an HMAC secret (HS256) or a private key (RS256, ES256). A server that knows the secret or public key can confirm the token wasn’t altered.

Standard claims

Claim Meaning
iss Issuer — who created the token
sub Subject — the user or entity the token is about
aud Audience — which service it’s intended for
exp Expiration time (Unix seconds)
nbf Not valid before
iat Issued at
jti Unique token ID

Applications add their own: roles, email, tenant, scopes.

Common problems the decoder helps diagnose

  • “401 Unauthorized” — check exp; the token has probably expired.
  • Wrong audience — aud doesn’t match the API you’re calling.
  • Missing role/scope — the payload doesn’t contain the permission you expected.
  • Clock skew — nbf is a few seconds in the future because the issuing server’s clock is ahead.
  • Wrong environment — iss points at a staging identity provider.

Security notes for developers

  • Always verify the signature server-side and reject alg: none.
  • Pin the expected algorithm; don’t let the token’s header choose it.
  • Keep tokens short-lived and use refresh tokens for long sessions.
  • Never store secrets or personal data beyond what’s needed in the payload — it’s readable by anyone holding the token.
  • Send tokens over HTTPS only, and prefer HttpOnly cookies over localStorage for browser apps.

Frequently asked questions

Is it safe to paste a token here?

The decoding happens entirely in your browser and the token is never transmitted. Even so, treat production tokens as credentials — a token that grants access to an account is worth as much as a password while it's valid.

Does this verify the signature?

No. Verification requires the signing secret or public key, which should never be pasted into a website. The decoder shows the signature and tells you which algorithm the header claims, so you can verify it in your own code.

Why is my token "expired"?

The exp claim is a Unix timestamp; if it's earlier than now, the token is no longer valid and any API will reject it. Tokens are typically issued for minutes to hours.

Why can I read the payload without a key?

JWTs are signed, not encrypted. The payload is just Base64URL-encoded JSON — anyone who has the token can read it. Never put secrets in a JWT payload.

Last updated August 26, 2026.