Decode a JWT
Decoding does not check the signature. It shows what the token says, not whether it is genuine.
See what is inside an access token or ID token: the algorithm, the user ID, the scopes and when it expires. The token is decoded in your browser and never sent anywhere.
- Free
- Runs in your browser
- Expiry check
- No sign-up
How It Works
Read a token in three steps.
Paste the token
From an Authorization header, a cookie or your browser's dev tools.
Read header and payload
Both parts are shown as formatted JSON.
Check the times
exp, iat and nbf are converted to dates, and you can see whether the token has expired.
What is inside a JSON Web Token?
A JWT has three parts separated by dots. The header says how the token was signed (for example HS256 or RS256). The payload holds the claims: who the token is for (sub), who issued it (iss), when it expires (exp) and anything else the issuer added. The signature proves the first two parts were not changed. Header and payload are only Base64URL-encoded, not encrypted, so anyone holding the token can read them.
Treat a live token like a password: anyone who has it can act as you until it expires. Decode it here, where it never leaves your browser, rather than on a site that sends it to a server.
Formatted JSON
Header and payload are pretty-printed, with a copy button for each.
Times as dates
exp, iat and nbf are Unix timestamps in seconds; they are shown in your local time and in UTC.
Expiry status
Compares exp with your device's clock and says whether the token is still valid in time.
No signature check
Verifying the signature needs the secret or public key, which you should not paste into a website.
Convert PDF Files and File Formats
Find the perfect online tool to combine PDF files, compress documents, and handle your daily workflow effortlessly.
PDF Tools
All your PDF needs in one place
- Merge PDF
- Organize PDF
- Split PDF
- Compress PDF
- Convert to Word
- Convert to Image
Image Tools
Edit and optimize your images
- Resize Image
- Compress Image
- Convert Format
- Crop Image
- Add Watermark
- Remove Background
Word Tools
Work with Word documents
- Convert to PDF
- Merge Documents
- Split Documents
- Compress File
- Edit Text
- Add Watermark
Excel Tools
Process Excel spreadsheets
- Convert to PDF
- Convert to CSV
- Merge Sheets
- Split Sheets
- Compress File
- Clean Data
Why Use This JWT Decoder
Built for debugging auth.
Token stays local
Decoding happens in your browser tab. Nothing is logged or uploaded.
Bearer prefix removed
Paste the whole Authorization header value; "Bearer " is stripped for you.
Readable timestamps
No more converting 1735689600 by hand to see when a token expires.
Spots encrypted tokens
Tells you when a token is a JWE, whose payload cannot be read without a key.
Frequently Asked Questions
Questions people ask about the JWT Decoder.
No. It decodes and displays the contents. Verifying the signature needs the signing secret or public key and should happen on your server with a JWT library.
The token is decoded with JavaScript in your browser and not sent anywhere. Even so, prefer an expired or test token when you can, and never share a live token in tickets or chats.
JWT times are Unix timestamps in seconds since 1 January 1970 UTC. The decoder converts exp, iat and nbf to dates for you. For other timestamps, use the Unix Timestamp Converter.
The token is not signed at all. Servers should reject such tokens unless they are deliberately configured to accept them, which is rarely a good idea.
Related Text & Developer Tools
More small utilities that run in your browser.
JWT Generator
Create and sign HS256, HS384 or HS512 test tokens.
Base64 Encode & Decode
Encode text to Base64 or decode it back.
JSON Formatter
Format, validate and minify JSON.
Unix Timestamp Converter
Convert Unix time to a date and back.
URL Parser
Split a URL into its parts and query parameters.