JWT Decoder Online

Paste a JSON Web Token below to decode its header and payload, read the expiration date in plain English, and see at a glance whether the token is still valid. This JWT decoder runs entirely in your browser — the token is never sent to a server.

What is a JWT?

A JSON Web Token (JWT) is a compact, URL-safe way to carry a set of claims between two parties. You will usually meet one as a long string in an Authorization: Bearer header, issued after a login and sent back on every request.

A JWT has three parts separated by dots: header.payload.signature.

• Header — which signing algorithm was used (alg) and the token type (typ).
• Payload — the claims themselves: who the token is about, when it was issued, when it expires.
• Signature — proof that the first two parts were not tampered with, produced with a secret or a private key.

The first two parts are only encoded, not encrypted. Anyone holding the token can read them — which is exactly what this decoder does.

How to use this JWT decoder

1. Copy the token from your browser’s developer tools, your API client, or your logs.
2. Paste it into the field above. A leading Bearer is stripped automatically, so you can paste the whole header value.
3. The header and payload are decoded as you type — there is no button to press.

Is it safe to paste a token here?

A JWT is a live credential: whoever holds it can act as you until it expires. That is why this tool does all its work in JavaScript, in your own browser. Nothing is uploaded, nothing is logged, and no request leaves your machine when you paste a token. You can disconnect from the network and the decoder still works.

That said, treat any token you are debugging as a password: do not paste it into a chat, a ticket, or a screenshot, and rotate it if it leaks.

Why does my token say “Expired”?

Most tokens carry three timestamps, stored as seconds since 1 January 1970 — unreadable at a glance, which is the usual reason people reach for a decoder. This tool converts all three into your local date and time:

• exp — expiration time. After this moment the token should be rejected.
• iat — issued at. When the token was created.
• nbf — not before. The token is not valid until this moment, even though it already exists.

If an API keeps answering 401 and the decoder shows Expired, the token is simply too old and you need a fresh one. If it shows Not valid yet, the clock on the machine that issued the token is probably ahead of yours.

Does this verify the signature?

No — and no decoder can do it without a secret. Checking an HS256 signature requires the shared secret, and an RS256 signature requires the issuer’s public key. Neither belongs in a web page you found on the internet.

Decoding tells you what a token claims. It does not tell you the claims are true. Always verify the signature on your server, with a library, before trusting anything inside a token.

What does “alg”: “none” mean?

It means the token carries no signature at all. The JWT specification allows it for cases where the transport is already trusted, but it is also a classic attack: strip the signature, set alg to none, and a careless server may accept a token anyone can forge. The decoder above flags these tokens with a warning. If one reaches your API in production, your verification step is broken.