Read the header, payload and expiry of a JSON Web Token.
Paste a token to read it.
Signature
This reads the token; it does not verify it. Anyone can edit a payload and re-encode it. Checking the signature needs the issuer's key, which does not belong in a browser tab.
Your token is decoded in this tab and never transmitted — it is usually a live credential.
Reads a JSON Web Token: the header, the payload, and the claims that matter — who issued it, who it is for, when it was issued and when it expires, shown as real dates rather than the Unix timestamps stored in the token.
Decoding is not verification, and the difference is the whole point. Anyone can edit a payload and re-encode it, and this tool will read the result perfectly happily. Checking that a token is genuine means verifying its signature against the issuer's secret or public key — which does not belong in a browser tab, and which no online decoder can do for you.
The token is decoded here on your device. That matters: a JWT usually grants access to something, and pasting a live one into a website is handing over a working credential.
An expired token is the most common cause, and the expiry is shown here in plain language rather than as a ten-digit number.
Roles, scopes, tenant ids and email addresses vary between providers. Reading one real token is faster than reading the documentation.
The issuer claim tells you whether a token came from staging or production, which explains a surprising share of authentication puzzles.
Seeing exactly what the client received, before your code touches it, separates a server problem from a client one.
The three dot-separated parts, with or without a leading “Bearer”. It decodes as you paste.
The header says which algorithm signed it. The payload holds the claims — everything the token asserts.
Issued, expires and not-before are converted to your local time with how long ago or how far ahead that is. An expired token is called out.
That the token decodes says nothing about whether it is genuine. Only signature verification does that, and it needs a key you should not paste into a website.
No, deliberately. Verifying needs the issuer's secret or public key, and any site asking you to paste that alongside the token is asking for the keys to your system. A decoded token that looks correct can be entirely forged.
No. It is decoded in this browser tab. A JWT is usually a live credential, so pasting one into a site that transmits it is equivalent to handing over a password.
Because JWT payloads are encoded, not encrypted. That is by design — the signature stops the contents being changed, not read. Never put anything secret in a JWT payload.
Expiry, issued-at and not-before, each as seconds since 1970. This tool converts them to local dates. A token is valid between nbf and exp; outside that window a correct server rejects it whatever else it says.
Then it is probably encrypted (a JWE) rather than merely signed, and its contents cannot be read without the key. The tool tells you how many parts it found so you can tell the difference from a truncated copy-paste.