What is a JSON Web Token?
A JSON Web Token, or JWT, is a compact way to pass claims between two parties, most often a client and a server. It is widely used for sign-in and API access: after you log in, the server returns a token, and your app sends it back with each request to prove who you are.
A JWT has three parts separated by dots: a header that describes the token, a payload that holds the claims, and a signature that lets the receiver check that the token was not changed. The first two parts are JSON encoded as Base64URL, which is why anyone who holds a token can read them.
How to decode a JWT
- Copy the token from your app, your browser's developer tools or an API response.
- Paste it into the box. A leading Bearer prefix is removed for you.
- Read the decoded header and payload, formatted as JSON.
- Check the expiry status and the table of time claims.
- Clear the box when you are done, especially if the token is still valid.
Decoding is not verifying
This tool decodes a token, but it does not check the signature, because that needs the secret or public key. A decoded token is therefore not proof that the token is genuine. Servers must always verify the signature, the issuer, the audience and the expiry before they trust any claim.
Also remember that a normal signed JWT is not encrypted. Anything in the payload can be read by anyone who gets the token, so never store passwords or other secrets in it.
Reading the standard claims
- iss (issuer): who created and signed the token.
- sub (subject): who the token is about, often a user id.
- aud (audience): who the token is meant for.
- exp (expiration time): after this time the token must be rejected.
- nbf (not before): the token is not valid before this time.
- iat (issued at): when the token was created.
- jti (JWT id): a unique id that can help prevent reuse.
Security tips
- Do not paste live production tokens into tools you do not trust. This tool works in your browser, but tokens can still grant access to an account.
- Reject tokens with the algorithm none, and never let the token decide which algorithm to trust.
- Keep token lifetimes short and use refresh tokens for longer sessions.
- Send tokens only over HTTPS and store them carefully on the client.
Example: reading an expiry
If the payload contains exp set to 1760000000, that is a Unix timestamp. The decoder shows it as a date in UTC and in your local time, and compares it with the present moment. A token that expired five minutes ago will be rejected by any correctly configured server, which is a common reason for 401 errors in an app that worked a few minutes before. Checking the exp and iat claims is usually the fastest way to find out whether the problem is an expired token or a signing issue.
Common JWT claims
| Claim | Name | Meaning |
|---|---|---|
| iss | Issuer | Who issued the token |
| sub | Subject | The user or entity the token describes |
| aud | Audience | The intended recipient |
| exp | Expiration time | Unix time after which the token is invalid |
| nbf | Not before | Unix time before which the token is invalid |
| iat | Issued at | Unix time when the token was issued |
Frequently Asked Questions
What does a JWT contain?
A header with the algorithm and type, a payload with claims, and a signature.
Is it safe to decode a JWT online?
Decoding here happens in your browser and nothing is sent. Even so, avoid sharing tokens that still grant access.
Can anyone read the payload of a JWT?
Yes. A signed JWT is encoded, not encrypted, so the payload is readable by anyone with the token.
Does this tool verify the signature?
No. Verification needs the secret or public key and should be done by your server.
How do I know if a token has expired?
The tool compares the exp claim with the current time and shows the result at the top.
What is Base64URL?
A variant of Base64 that uses minus and underscore instead of plus and slash, so it is safe inside URLs.
What is a JWE?
A JSON Web Encryption token, which encrypts the payload. This tool decodes signed tokens, not encrypted ones.