JWT Decoder

What Is the JWT Decoder?

The JWT Decoder reads a JSON Web Token (JWT) and shows its contents in plain JSON. A JWT is a compact token made of three parts separated by dots: header.payload.signature. The header says how the token was signed, the payload carries claims such as the user ID and expiry time, and the signature lets a server verify that the token has not been tampered with. Each part is encoded with base64url, which looks like random characters until it is decoded.

JWTs are used for login sessions and API authentication. A server issues a token after you log in, and your browser or app sends it with later requests to prove who you are. Decoding a token helps you inspect what it contains, check when it expires, and debug authentication problems. Decoding only reads the token; it does not verify the signature or prove the token is trustworthy.

How to Use the JWT Decoder

1. Copy the JWT you want to inspect. It has three dot-separated sections and starts with eyJ when the header is standard JSON.
2. Paste the token into the decoder input.
3. Read the decoded header and payload, shown as formatted JSON.
4. Check the exp claim to see when the token expires and the iss and aud claims to see who issued it and who it is for.
5. If you are debugging, compare the decoded payload against what your application expects, such as the user ID, roles, or permissions.

Worked Example

Take the widely used example token whose payload decodes to:

{
  "sub": "1234567890",
  "name": "John Doe",
  "iat": 1516239022
}

The header decodes to {"alg": "HS256", "typ": "JWT"}, meaning the token was signed with HMAC-SHA256. In the payload, sub (subject) is the user ID 1234567890, name is John Doe, and iat (issued at) is 1516239022, a Unix timestamp equal to 18 January 2018 at 01:30:22 UTC.

If the payload also contained "exp": 1516242622, the token would expire at 18 January 2018 at 02:30:22 UTC, exactly one hour after it was issued, because 1516242622 − 1516239022 = 3600 seconds.

Limitations

• Decoding is not verification. This decoder shows what a token says; it does not check the signature, so a forged token with a fake payload will still decode and look plausible.
• A decoded token can be read by anyone who has it. JWT payloads are encoded, not encrypted, so never put passwords, secrets, or sensitive personal data in a token.
• The decoder cannot tell you whether a token was revoked. A token that decodes correctly and has not expired may still have been revoked on the server.
• Timestamps in claims are Unix timestamps in seconds. A value in milliseconds, or a missing exp claim, will make expiry look wrong.
• Some tokens are encrypted (JWE) rather than merely signed. An encrypted token cannot be decoded by this tool because its contents are not readable without the decryption key.

Frequently Asked Questions

What does each part of a JWT contain?

The header names the signing algorithm, such as HS256 or RS256, and the token type. The payload holds claims: registered claims like iss, exp, sub, and aud, plus any custom claims the issuer added. The signature is a cryptographic check value computed over the header and payload.

Is it safe to paste a real JWT into an online decoder?

Only paste test or development tokens. A real production token can act as a login credential: anyone who copies it may be able to use it until it expires. For production tokens, decode them locally with your own tools instead.

Why does my token say it is expired?

Compare the exp claim with the current Unix time. If exp is in the past, the token has expired and you need a fresh one. Also check that the value is in seconds, not milliseconds: a millisecond timestamp would be about 1,000 times larger than expected.

Can a decoded token still be invalid?

Yes. Decoding only shows the contents. A token can still be rejected because its signature does not verify, its issuer or audience does not match, it was revoked, or its nbf (not before) time has not yet arrived.