What is a JWT?
A JSON Web Token (JWT, pronounced "jot") is a compact way for a server to give a client a signed piece of information, usually to prove who you are after logging in. It is made of three Base64URL-encoded parts separated by dots: a header that names the signing algorithm, a payload with "claims" such as the user ID and expiry time, and a signature that stops the token from being changed.
header.payload.signature
How to decode a token
- Paste the token. If you copied it from an Authorization header, the word
Beareris removed automatically. - Read the decoded header and payload as formatted JSON.
- Check the table of standard claims, where timestamps are shown as normal dates and times, and see whether the token has expired.
Standard claims
| Claim | Meaning |
|---|---|
iss | Issuer: who created the token |
sub | Subject: usually the user ID |
aud | Audience: which app the token is for |
exp | Expiration time, in seconds since 1 January 1970 (Unix time) |
nbf | Not before: the token is not valid until this time |
iat | Issued at: when the token was created |
jti | Unique token ID, used to block reuse |
Important: decoding is not verifying
The header and payload are only encoded, not encrypted, so anyone who has a token can read them, exactly as this tool does. That is why you should never put passwords or other secrets in a JWT payload. Checking that a token is genuine requires verifying the signature with the secret key or public key, which must happen on your server. This tool deliberately does not ask for your key.
Frequently asked questions
Is it safe to paste a real token here?
The token is decoded in your browser and not sent anywhere. Still, treat live tokens like passwords and prefer expired or test tokens.
Why does my token show "expired" when it still works?
Check your computer's clock. Expiry is compared with your device's current time.
What does alg "none" mean?
An unsigned token. Servers should reject such tokens unless they were designed to accept them.