🔑 JWT Decoder
Paste a token and read it instantly. Expiration times are shown in your local time zone and UTC — and the token never leaves your browser.
⚠️ This tool only decodes. It does not verify the signature, so never use it to decide whether a token is genuine — verify on the server.
How to use the JWT decoder
- Paste a JWT into the box and it's decoded immediately. A leading
Bearer(as copied from anAuthorizationheader) is stripped automatically. - Below the input, the token is color-coded into its three parts: header, payload and signature.
- The header and payload panels show pretty-printed JSON; use copy to grab either one.
- The claims table translates time claims such as
exp,iatandnbfinto your local time, UTC and "in 2 hours / 3 days ago," and flags the token as VALID or EXPIRED. - Click sample to generate a demo token issued 10 minutes ago that expires in 50 minutes.
What is a JWT?
A JSON Web Token (JWT, pronounced "jot", defined in RFC 7519) is a compact token format used to pass login sessions and permissions between a client and an API — it's what OAuth 2.0 and OpenID Connect providers like Auth0, Okta, Firebase and AWS Cognito hand out. A JWT looks like xxxxx.yyyyy.zzzzz: three Base64URL-encoded parts separated by dots.
- Header — the signing algorithm (
alg, e.g. HS256 or RS256) and token type (typ). - Payload — the claims: user ID, roles, scopes, expiration time and so on.
- Signature — the header and payload signed with a secret or private key. This is what prevents tampering.
The header and payload are only encoded, not encrypted, so anyone can read them without a key. That's exactly what this decoder does.
Standard claims and how times are shown
| Claim | Meaning | Shown as |
|---|---|---|
iss / sub / aud | Issuer / subject (user) / audience | Raw value |
iat | Issued at | Local time + UTC + relative time |
nbf | Not valid before this time | NOT YET if it's in the future |
exp | Expiration time | VALID / EXPIRED |
ttl | exp − iat (computed) | Seconds and hours |
Time claims are Unix timestamps in seconds since 1970-01-01 00:00:00 UTC. For example, "exp": 1759622400 is 2025-10-05 00:00:00 UTC — October 4, 2025, 8:00 PM in New York (EDT). If you see a year like 57,000, the issuer put milliseconds where seconds belong. Use the Unix timestamp converter for any other epoch value.
Security tips
- Never put passwords, SSNs or other secrets in a JWT payload — it's readable by anyone who has the token.
- Keep access tokens short-lived (5–15 minutes is common) and rely on refresh tokens for longer sessions.
- On the server, always pin the expected algorithm when verifying. Accepting
alg: noneor mixing HS256/RS256 keys are classic JWT vulnerabilities.
This tool does not verify signatures. A token that decodes cleanly is not necessarily genuine, so authentication decisions must happen on the server. Encrypted tokens with five parts (JWE) can't be read without the key. Decoding happens entirely in your browser — still, clear production tokens from the box when you're done.