JWT Decoder

Decode JSON Web Tokens and check their claims and expiry.

Usage

Paste a token into the box above. A leading Bearer (as in an Authorization header) is removed automatically.

The tool shows whether the token is currently valid, its header and payload as formatted JSON, and the registered claims in readable form: issuer, subject, audience, token ID and the expiry, not-before and issued-at times as dates. The status and relative times update live.

What is a JWT?

A JSON Web Token consists of three parts separated by dots: a header, a payload and a signature. Header and payload are JSON objects encoded with Base64URL, so anyone can read them. The signature proves that the token was issued by someone holding the secret or private key and wasn't changed since.

The signature is not verified here, as that needs the issuer's secret or public key.

Privacy

This tool runs entirely in your browser and does not send any data to a server, so pasting real tokens is safe. Still, treat them like passwords while they are valid.

Something not working as expected? Let me know.