JWT Decoder & Parser
Decode and analyze JSON Web Tokens (JWT) safely in your browser.
Encoded Token
Client-side fetch; CORS must allow the request.
JWT Scenarios & Examples
Standard Access Token
A typical authenticating token with subject, issuer, and expiration.
{
"sub": "1234567890",
"name": "John Doe",
"iat": 1516239022,
"exp": 1516242622,
"iss": "https://auth.example.com"
}Examples
Decode a standard HS256 sample JWT
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5cHeader:
{
"alg": "HS256",
"typ": "JWT"
}
Payload:
{
"sub": "1234567890",
"name": "John Doe",
"iat": 1516239022
}The decoder Base64URL-decodes and parses the first two segments; this readable output does not prove that the signature is valid.
Decode payload claims containing issued-at and expiration times
eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyLCJleHAiOjE1MTYyNDI2MjJ9{
"sub": "1234567890",
"name": "John Doe",
"iat": 1516239022,
"exp": 1516242622
}JWT NumericDate claims such as iat and exp are seconds since the Unix epoch, not JavaScript milliseconds.
About this tool
A JWT packs three Base64URL parts into one dot-separated string: a header naming the algorithm, a payload with the claims, and a signature. Paste a token and the decoder splits it, prints header and payload as formatted JSON, and annotates each known claim. Base64URL is an encoding, not encryption — anyone holding the token can already read it.
Time claims get special treatment: exp, nbf and iat hold Unix seconds, so each becomes a local date with a past/future badge and a live countdown to expiry. The analysis surfaces iss, sub and aud, and warns when the header says alg: none. Verification is optional: an HMAC secret checks HS256/384/512 signatures, a JWKS URL covers RS, PS and ES, and both run client-side (JWKS needs CORS). For full rule checks, use the JWT Validator tool.
What this tool does not do
- Decoding is not signature verification. Anyone can mint a Base64URL payload; do not authorize from decoded claims alone.
- The token never leaves the browser, but a pasted production JWT is still a bearer credential — treat the page as you would a password field.
How to use this tool
Paste the token
Copy the complete eyJ… string — a token needs all three dot-separated parts.
Read the decoded JSON
Header and payload appear formatted; the signature stays encoded because it is raw bytes.
Check the timeline
Compare the iat, nbf and exp dates plus the expiry countdown against your flow.
Verify when it matters
Add an HMAC secret or JWKS URL to confirm the signature before trusting the token.
Use cases
Debugging rejected API requests
Inspect alg, kid, iss, aud, scope, and exp when a bearer token is structurally accepted by a client but rejected by an API gateway or resource server.
Reviewing identity and authorization claims
Read subject, tenant, role, and scope claims to confirm that an identity provider issued the shape your application expects before separately verifying the token.
Checking token timing during development
Inspect exp, iat, and nbf values to diagnose clock-skew, premature-use, and expiration issues while remembering that decoded values remain untrusted until verification.
Building sanitized fixtures and bug reports
Copy the decoded structure into a test fixture or issue after replacing user data and credentials; avoid sharing live production tokens because they are bearer credentials.
Registered claims
| Claim | Meaning |
|---|---|
| iss | Issuer that created and signed the token |
| sub | Subject the token is about, usually a user ID |
| aud | Recipients the token is meant for |
| exp | Expiry time, shown as a readable local date |
| nbf | Earliest time the token counts as valid |
| iat | Moment the token was issued |
| jti | Unique token ID for revocation lists |
exp, nbf and iat are NumericDate values: seconds since 1970-01-01 UTC.
Common mistakes
Mistake:Trusting claims merely because the token decoded successfully.
Fix:Anyone can construct a Base64URL payload. Verify the signature with an approved algorithm and trusted key, then validate issuer, audience, time claims, and application-specific requirements before using any claim.
Mistake:Reading exp, iat, or nbf as milliseconds.
Fix:JWT NumericDate values are seconds since 1970-01-01T00:00:00Z. Multiply by 1000 only when constructing a JavaScript Date.
Mistake:Assuming an alg value of none is automatically rejected.
Fix:A decoder can still parse an unsecured JWT. Configure the production verifier with an explicit algorithm allowlist and reject none unless an exceptional protocol explicitly requires unsecured tokens.
Mistake:Confusing decoding with signature verification.
Fix:Decoding needs no key and only reveals JSON. Verification cryptographically checks the signed input and must happen in a trusted server-side JWT library before authorization decisions.
Frequently asked questions
Is decoding a JWT the same as verifying it?
No. Decoding merely reverses Base64URL so the parts become readable; verification recomputes and compares the signature. This page can optionally check HS* and RS/PS/ES signatures, but a plain decode never proves authenticity.
Why does my JWT show an 'exp' in the past?
The token has expired. exp holds Unix seconds, and servers reject the token once that moment passes; the decoder converts it to your local date so you can see exactly when it lapsed.
Can a JWT payload be encrypted?
Not in a plain JWT, which is signed but readable. JWE (JSON Web Encryption) wraps the payload for secrecy — which is also why this decoder can display every ordinary claim in clear text.
Is it safe to paste a production token here?
Decoding runs entirely in your browser and the token is never uploaded; the only network call is the JWKS fetch you trigger. Even so, treat tokens like passwords and avoid pasting live ones out of habit.
Related guides
JWT Validator: Verify Signatures and Claims Online
Validate HS256 and RS256 JWT signatures plus exp, nbf, aud and iss claims — client-side, pairs with JWT Decoder. Confirm claims after you decode the token.
Reading a PEM Certificate: Subject, Issuer, SANs and Expiry
What the fields in a PEM certificate mean, why Subject Alternative Names matter more than the Common Name, and how to decode expiry and key usage.
curl vs Postman vs Hoppscotch: Which API Tool When?
An honest comparison of the three ways developers test APIs — the terminal, the heavyweight GUI, and the open-source web app — plus how to turn any curl command into real code.
Best Free Developer Tools in 2026: An Honest Comparison
The best free, browser-based developer tools compared — CyberChef, Regex101, JWT.io, and the privacy-first alternatives. What to use for JSON, regex, JWTs, hashing, UUIDs, and more.
References & standards
Related tools
JWT Validator
Verify HS256 and RS256 JWT signatures and validate exp, nbf, aud and iss claims
JWT Signer
Create and sign JSON Web Tokens with HMAC, RSA, or ECDSA algorithms using the Web Crypto API.
Base64 Toolbox
Professional Base64 workspace for text, files and images with Base64URL, MIME, Data URI, strict validation, image preview and ready-to-use snippets.
Timestamp Converter
Convert between Unix timestamps and human-readable dates with timezone support, multiple formats, and comprehensive date analysis