JWT Decoder
Inspect headers, claims, and expiration.
How to use JWT Decoder
Paste a three-part JWT to read its header and payload. Expiration is compared with your device clock.
Good to know
Decoding does not verify a signature or prove a token is trustworthy. Never use this result as an authorization decision. Encrypted JWTs are not supported.
Read a token without trusting it
Choose Decode to try this example.
Input
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJkZW1vIiwiZXhwIjoxNzAwMDAwMDAwfQ.signature
Expected result
Header: {"alg":"HS256","typ":"JWT"}
Payload: {"sub":"demo","exp":1700000000}
Expires: 2023-11-14T22:13:20.000Z
Signature: NOT verifiedCommon questions and mistakes
Why can I read a JWT without a secret?
A signed JWT usually encodes its header and payload as Base64URL. Encoding makes the data transportable; it does not hide it. The signature helps a verifier detect tampering, but this decoder does not check that signature. The example token uses a dummy signature.
Does “Not expired” mean a token is valid?
No. A server also needs to verify the signature, accepted algorithm, issuer, audience, and other applicable claims. The expiration result here only compares a numeric exp claim with your device clock. JWT timestamps are seconds, not milliseconds.
Related tools
- Unix Timestamp Converter — Switch between epoch time and UTC dates.
- Base64 Encoder / Decoder — Convert Unicode text to and from Base64.