JWT Decoder — see what is inside a token
Open a JSON Web Token: header, payload and expiry. Everything runs in your browser and nothing is sent anywhere.
JWT token
Characters: 0Segments: 0
This token
Paste a token — everything inside it appears here
The token never leaves your browser
How a JWT is built
A JSON Web Token is three base64url segments separated by dots. The first two are plain JSON: they are signed but NOT encrypted, so anyone holding the token can read what is inside. The signature only proves the token has not been altered.
Header
Which algorithm signed it (alg) and what kind of token it is (typ). Sometimes a key id — kid — lives here too.
Payload
The claims: who, for whom, until when. Plain text, which is why secrets never belong here.
Signature
A signature over the header and payload, made with a shared secret or a private key. It alone proves the token is genuine.
Registered claims (RFC 7519)
| Claim | Name | Meaning |
|---|---|---|
| iss | Issuer | Who issued the token — usually the auth server's URL. The receiving side checks it against an allow-list. |
| sub | Subject | Who the token is about. In most systems an internal user id rather than an email, because emails change. |
| aud | Audience | Who the token is for. Checked so one service does not accept another service's token. |
| exp | Expiration Time | After this moment the token must not be accepted. Seconds since the epoch. |
| nbf | Not Before | The token is not yet in force until this moment. Rarely used. |
| iat | Issued At | When the token was issued. Together with `exp` it gives the token's lifetime. |
| jti | JWT ID | A unique id for the token, used to stop the same one being replayed. |
Frequently asked questions
Is a JWT encrypted? Can anyone read the payload?
A JWT is signed, not encrypted. The header and payload are plain base64url, so anyone holding the token can decode and read them in a second. The signature guarantees exactly one thing: that the token has not been altered in transit. That is why passwords, card numbers and other secrets never go in the payload.
Does this tool verify the signature?
No, and that is deliberate. Verifying needs the server's shared secret (for HS256) or its public key (for RS256). Typing a shared secret into a web page is the easiest way to leak it, even if the page sends it nowhere. Verification belongs on the server, in a library.
How do I know whether a token has expired?
The exp claim in the payload is a count of seconds since the epoch. The tool compares it with your browser's clock and says so in one sentence at the top: still valid or expired, and when. If a token carries no exp at all, the tool says "no expiry claim" rather than "valid" — calling something valid that was never checked would be the wrong answer.
Is my token sent to a server?
No. Decoding happens in your browser, and after the page has loaded this tool makes no network requests at all. The token is not stored either: refresh the page and it is gone.