JWT Decoder
Read the header, payload and time claims of a JSON Web Token. The token is decoded in your browser. The signature is shown but not verified.
Signature NOT verified This tool does not check the signature. Anyone can make a token with any contents, so the decoded fields do not prove who issued the token or that it was not changed.
Time claims
Expiry checks use the clock on your device.
| Claim | Value as received | UTC time | Status |
|---|
Decoded header
-
Decoded payload
-
Signature (as received)
Not verified
-
How it works
The token is decoded in your browser. Nothing is sent to a server, and the page does not store the token. Close the page or clear the box and it is gone.
The token is split at its two dots into a header, a payload and a signature. The header and payload are decoded from base64url, read as UTF-8 text and parsed as JSON objects. The time claims exp, nbf and iat are shown as UTC times, and the algorithm is taken from the header. The signature is shown exactly as you pasted it.
A decoded token does not prove who issued it. Checking a signature needs the issuer's key, which this page does not have, so it does not verify the signature. Only your own server should accept a token, and only after it has verified the signature and the claims it relies on.
Expiry and not-before flags compare the claims with the clock on your device, so a wrong clock gives a wrong flag.