1
Paste the token
Paste a JWT. A leading "Bearer " or Authorization header is removed for you.
Developer Tools
JWT Decoder
Decode a JSON Web Token's header and payload in your browser. Decoding does not verify the signature.
Paste a JSON Web Token to read its header and payload and see whether it has expired, without sending it anywhere. Decoding does not verify the signature. Claim timestamps are Unix times; the Timestamp Converter can convert others.
Your token never leaves your device. It is decoded entirely in your browser.
Decoding is not verification. This tool does not check the signature, issuer, audience or any other rule, and anyone can create a token with any contents. Never trust decoded claims as proof of identity; verify tokens on your server using the correct key.
0 characters
How it works
Private JWT decoding in your browser
2
Read the claims
See the decoded header and payload, plus expiry and issue times in plain language.
3
Check the warnings
Notes flag unsigned tokens, missing algorithms and invalid time claims.
Use cases
When this comes in handy
Debug an authentication problem
Check whether a token has expired, which audience it targets or which claims it carries.
Inspect a token from an API
Read the claims returned by an identity provider while developing an integration.
Understand token contents
See exactly what information a token exposes to anyone who holds it.
FAQ
Common questions
Does this verify the token's signature?
No. This tool only decodes the header and payload. It does not check the signature, issuer, audience or any other validity rule, so decoded contents must not be trusted just because they decode. Verify tokens on your server with the correct key.
Is my token sent anywhere?
No. Decoding happens entirely in your browser. Even so, treat live tokens as secrets and prefer expired or test tokens when you can.
Why can anyone read a JWT's contents?
A standard signed JWT (JWS) is encoded, not encrypted. The signature only proves the contents were not changed. Do not put secrets in a token payload.
Can it decode encrypted tokens (JWE)?
No. Encrypted tokens have five parts and need the decryption key; the tool tells you when it sees one.
How is the expiry status worked out?
Expiry (exp), not-before (nbf) and issued-at (iat) are compared with your device's current clock. If your clock is wrong, the status will be too.
Related Tools