Free JWT Decoder
Paste a JSON Web Token to read its header and payload, see when it was issued and when it expires, and spot common security problems. Decoding happens on your device.
JWT Decoder: Paste a JSON Web Token to read its header and payload, see when it was issued and when it expires, and spot common security problems. Decoding happens on your device. It is free, needs no sign-up and runs in your browser. How to use it: 1) paste the token, with or without the Bearer prefix; 2) read the status, header, payload and claims table; 3) optionally enter the HMAC secret to check an HS256 signature locally. A JSON Web Token has three parts separated by dots: a header, a payload and a signature. The first two parts are JSON encoded with URL safe Base64, so anyone holding the token can read them.
How the JWT decoder works
A JSON Web Token has three parts separated by dots: a header, a payload and a signature. The first two parts are JSON encoded with URL safe Base64, so anyone holding the token can read them. The tool splits the token, decodes both parts, formats the JSON and colours each part so you can see where one ends and the next begins.
Claims and dates
Standard claims are explained in plain words, for example iss (issuer), sub (subject) and aud (audience). Time claims such as exp, iat and nbf are Unix timestamps; the tool shows them in your local time, in UTC and as relative time. The status badge tells you whether the token is valid, expired or not active yet.
Security checks
- Tokens with the algorithm none are flagged as unsigned.
- Tokens without exp are flagged because they never expire.
- Very long lifetimes and claims that look like passwords are highlighted.
- Encrypted tokens (JWE, five parts) are recognised; only their header is readable.
Signatures
Decoding does not verify the signature. A server must check it with the right secret or public key before trusting any claim. For HS256, HS384 and HS512 you can optionally type the secret, and the tool checks the signature with Web Crypto on your device.
Limitations
RS256, ES256 and other public key signatures are not verified here. Expiry status uses your device clock.
JWT Decoder FAQs
Is it safe to paste my JWT into this decoder?
Decoding runs entirely in your browser and the token is never sent to any server, so this page does not leak it. Still, treat live tokens like passwords: anyone who has one can use it until it expires. Prefer test tokens, and revoke any production token you shared by mistake.
Does decoding a JWT verify it?
No. Decoding only reads the header and payload, which are not encrypted. Verification checks the signature with the secret or public key and must happen on your server before you trust any claim. This tool can optionally verify HMAC signatures locally if you enter the secret.
What do exp, iat and nbf mean in a JWT?
They are times in seconds since 1 January 1970 UTC. iat is when the token was issued, nbf is the earliest time it can be used and exp is when it expires. Servers should reject tokens outside that window. The decoder converts each one into a readable date and relative time.
Why does my JWT show as expired?
The exp claim is earlier than the current time on your device. Access tokens are often valid for only 5 to 60 minutes, and the app should use a refresh token to get a new one. If the time looks wrong, check that your device clock and time zone are correct.
Want our experts to implement these improvements?
Get professional support from Hayyat Networks. Request a free consultation.