JWT Decoder
Paste a JSON Web Token to read its header and payload and see when it was issued and when it expires. Decoding happens entirely in your browser.
How it works
Reading a JWT
Three parts
A JWT is header.payload.signature, each part Base64URL-encoded. The header names the algorithm; the payload carries the claims.
Decoded is not verified
Anyone can read a JWT's payload. Only verifying the signature with the right key proves it was issued by your server and not changed.
Common claims
iss is the issuer, sub the subject, aud the audience, and iat, nbf and exp are Unix timestamps for issued-at, not-before and expiry.
FAQ
Frequently asked questions
Is it safe to paste a production token?
The page decodes locally and sends nothing, but treat live tokens like passwords: prefer expired or test tokens when you can.
Why is alg none dangerous?
An unsigned token can be forged by anyone. Servers must reject alg none and only accept the algorithms they expect.
More free tools
All toolsOpenAI-compatible model gateway