How to use the JWT Decoder
- Paste a token (starts with
eyJ). - Click Decode.
- Review header, payload and the expiry status.
About this tool
A JSON Web Token (JWT, RFC 7519) is three Base64URL-encoded parts joined by dots: a header naming the signing algorithm, a payload of claims (who the user is, when the token expires), and a signature. Because the first two parts are only encoded, anyone holding a token can read them — which is exactly why this decoder is useful for debugging authentication.
Claims you'll see most
| Claim | Meaning |
|---|---|
sub | Subject — usually the user ID |
iat | Issued-at time (Unix seconds) |
exp | Expiry time — we flag expired tokens |
aud / iss | Intended audience and issuer |
Security note: never paste production tokens into tools that send them to a server. This decoder runs locally. It does not verify signatures — verification requires the secret or public key and must happen on your backend.
Frequently asked questions
Can you verify the signature?
Not here — verification needs your secret or public key, which should never be pasted into a website.
Why is my token 'expired'?
Its exp claim is earlier than your device clock. Check clock skew if it just expired.
Is a JWT encrypted?
Standard signed JWTs (JWS) are not encrypted. Encrypted JWTs (JWE) have five parts and can't be decoded without a key.