ShethHub

JWT Decoder

Paste a JWT to read its header and payload, with exp, iat and nbf shown as readable dates. This tool decodes only: it does not verify the signature, so a decoded token is not proof of who issued it. Decoding happens in your browser — the token is never uploaded.

Runs locally in your browser

Decode only — the signature is not verified. Never treat a decoded token as proof of who sent it. Decoding runs locally; the token is not uploaded.

How to use JWT Decoder

  1. Paste a token. Paste a JWT (a "Bearer " prefix is fine) into the input panel.
  2. Decode. Click Decode to read the header, payload and time claims.
  3. Review warnings. Check any warnings, then copy the header or payload.

Example

Decoding an HS256 token with issued-at and expiry claims.

Token

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkFkYSBMb3ZlbGFjZSIsImlhdCI6MTcwMDAwMDAwMCwiZXhwIjoxNzAwMDAzNjAwfQ.c2lnbmF0dXJl

Payload

{
  "sub": "1234567890",
  "name": "Ada Lovelace",
  "iat": 1700000000,
  "exp": 1700003600
}

The tool also shows exp as 2023-11-14T23:13:20.000Z and iat as 2023-11-14T22:13:20.000Z, one hour apart, and marks the token as expired.

Formats, limits and privacy

Input
Plain text
Output
JSON
Limits
  • Decodes JWS tokens (header.payload.signature). Encrypted JWE tokens, which have five parts, cannot be read without the key.
  • Does not verify signatures, so it cannot tell you whether a token is genuine.
  • Expiry is judged against your device clock.
Privacy
Everything happens in your browser. Your input is never uploaded to a server.

Troubleshooting

"A JWT has 3 dot-separated segments"

Part of the token is missing, often cut off when copying from a log or header. Copy the full value; a "Bearer " prefix is fine.

The token shows as expired but my app accepts it

Check your device clock, and whether your server allows clock skew. exp is in seconds; a value 1000 times too large means it was written in milliseconds.

The payload is unreadable

The token may be encrypted (JWE, five parts) or not a JWT at all, such as an opaque access token. Only the issuer can read those.

Frequently asked questions

Is my token uploaded anywhere?

No. Decoding runs entirely in your browser. Even so, avoid pasting live production tokens into any website you do not control.

Does this verify the signature?

No. It only decodes the header and payload, which are plain base64url-encoded JSON. Anyone can create a token with any contents, so a decoded token proves nothing about who issued it. Verify signatures on your server with a trusted key and a fixed, expected algorithm.

What does the alg "none" warning mean?

A token with alg "none" is unsigned. Servers must never accept such a token as proof of identity.

Why are exp, iat and nbf shown as dates?

These claims are Unix timestamps in seconds. The tool converts them to UTC dates and tells you whether the token is expired or not yet valid relative to your device clock.