JWT Decoder
Paste a JSON Web Token to read its header, payload and expiry. Decoded in your browser; the signature is not verified.
{
"alg": "HS256",
"typ": "JWT"
}{
"sub": "1234567890",
"name": "Alex Morgan",
"iat": 1700000000,
"exp": 1700003600
}Common JWT claims
- sub: the subject, usually the user ID.
- iss / aud: who issued the token and who it is for.
- exp / iat / nbf: expiry, issue time and not-before time, as Unix timestamps in seconds.
- alg (header): the signing algorithm, such as HS256 or RS256. Servers should never accept "none".
Frequently asked questions
How do I decode a JWT?
Paste the token. The header and payload are decoded and shown as formatted JSON, with exp, iat and nbf turned into readable dates.
Does this verify the JWT signature?
No. Verifying needs the signing secret or public key, which you should never paste into a website. Decoding only shows what the token says; anyone can read a JWT payload, which is why tokens must not contain secrets.
Is my token sent anywhere?
No. It is decoded in your browser. Even so, treat live tokens as passwords and prefer test tokens when debugging.
Why is my token expired?
The exp claim is a Unix timestamp. If it is earlier than the current time, servers that check it will reject the token, and you need to sign in or refresh the token.
Related free tools
Base64 decoder · Unix timestamp converter · JSON formatter · SHA-256 generator