JWT decoder
Read a JSON Web Token’s header, claims and times without sending it anywhere.
Free, no sign-up.
JWT decoder
What is inside a JWT
A JSON Web Token is three parts joined by dots: a header saying how it was signed, a payload of claims, and a signature. The first two are JSON written in URL-safe Base64 with no padding, which is why most tokens start with eyJ, the encoded start of {". Anyone holding a token can read them; only the signature needs the key.
Common claims: iss (who issued it), sub (who it's about), aud (who it's for), exp (when it expires), nbf (not valid before) and iat (when it was issued). The times are Unix timestamps in seconds: the sample token's iat of 1516239022 is 2018-01-18 01:30:22 UTC, which the date converter will show in any time zone.
Decoding is not verifying
This page reads a token; it can't tell you whether the token is genuine. Your server must check the signature with the right key, reject the algorithm "none", and check exp and aud before trusting anything in the payload. Because the payload is readable, never put secrets in it.
More developer tools
- Base64 encode and decode: Decode Base64 to text, or encode text as standard or URL-safe Base64.
- URL encode and decode: Make text safe for a URL, or turn percent-encoded text back into words.
- JSON formatter: Check JSON, see where it breaks, then format it for reading or minify it.
- UUID generator: Random version 4 UUIDs, one or up to fifty at a time.
- SHA-256 hash: The SHA-256 digest of any text as you type, with SHA-1, SHA-384 and SHA-512 beside it.
- Token generator: Secure random strings for keys, secrets and test data.
- All developer tools on one page
Paste a JSON Web Token to see its header and payload as formatted JSON, with the issued-at, not-before and expiry times written as dates. Tokens often carry account details, so this one never leaves your browser.
How it works
- Paste the token — The three dot-separated parts, starting eyJ…
- Decode — See the header, the payload and its times.
- Copy what you need — Each part has a Copy button.
Examples
- A sample token’s payload — {"sub": "1234567890", "name": "John Doe", "iat": 1516239022}
FAQ
- Does it verify the signature? — No. It shows what a token says, not whether it is genuine; verify signatures on your server.
- Is it safe to paste a real token? — It never leaves your browser here, but treat live tokens like passwords anywhere else.
- Is my token stored? — No. It runs in your browser; what you paste is never sent anywhere.