JWT Decoder

Decode a JSON Web Token and inspect its header and claims.

JSON Web Token

A Bearer prefix is stripped automatically.

Algorithm

HS256

JWT

Expiry status

Checking…

Signature

7pQhZ9wJ1x0a…

Not verified — see the note below

Headerjson

{
  "alg": "HS256",
  "typ": "JWT"
}

Payloadjson

{
  "sub": "1234567890",
  "name": "Ada Lovelace",
  "iss": "https://example.com",
  "iat": 1770000000,
  "exp": 1770003600
}

Registered claims are named; timestamps are converted to readable dates.
Claim	Meaning	Value
sub	Subject	1234567890
name	—	Ada Lovelace
iss	Issuer	https://example.com
iat	Issued at	1770000000 (2 Feb 2026, 02:40:00 UTC)
exp	Expires at	1770003600 (2 Feb 2026, 03:40:00 UTC)

Signatures are not verified

Verifying a signature requires your secret or public key, and pasting a signing secret into any web page is a bad idea. Verify on your server. Note also that a signed JWT is not encrypted — anyone holding the token can read its payload, so never put secrets in it.

What does JWT Decoder do?

Paste a JWT to see its header and payload decoded as formatted JSON, with the standard claims interpreted — issuer, audience, subject, and the timestamps converted into readable dates with an expiry check.

How to Use JWT Decoder

1
Paste the tokenThe three dot-separated segments.
2
Read the decoded partsHeader, payload and claim interpretation.
3
Check the expiryShown as a status with the remaining time.

Key Features

Header and payload decoded and pretty-printed
Standard claims interpreted: iss, sub, aud, exp, nbf, iat and jti
Timestamps converted to readable dates with time remaining
Expiry status shown prominently
Algorithm from the header displayed, with a warning for "none"
Signature shown but explicitly not verified

Frequently Asked Questions

Does this verify the signature?

No. Verification requires your secret or public key, and pasting a signing secret into any web page is a bad idea. Verify signatures on your server, where the key belongs.

Is a JWT encrypted?

A standard signed JWT is not. The header and payload are Base64URL-encoded, which anyone can decode. The signature proves the token was not altered — it does not hide the contents. Never put secrets in a JWT payload.

What do the claim abbreviations mean?

iss is the issuer, sub the subject, aud the intended audience, exp the expiry time, nbf the earliest valid time, iat when it was issued and jti a unique token ID. All are Unix timestamps in seconds.

Is it safe to paste a token here?

Decoding happens entirely in your browser and nothing is transmitted. Even so, a live access token is a credential — prefer an expired or test token, and rotate anything you paste anywhere.