JWT Decoder
Paste a JSON Web Token to read its header and payload, with exp, iat and nbf converted to dates. Nothing is sent anywhere.
Free · No sign-up · Your inputs stay in your browser
Input
Decode a JSON Web Token
Output
Signed with HS256
Header
Payload
exp
2026-01-01T01:00:00.000Z
Expiry, in UTC. Compare it with the time on the server that checks it.
iat
2026-01-01T00:00:00.000Z
This shows what the token claims. It does not verify the signature, so it cannot tell you whether to trust it.
Runs in this browser. Nothing you paste is sent to a server.
About this tool
Method, assumptions, practical next steps, and limits.
Decoding is not verifying
The header and payload of a JWT are only Base64URL-encoded, so anyone holding the token can read them. Trust comes from the signature, which the server checks with its key. That is why a payload must never contain a password or anything else you would not print in a log.
The claims you will see most
sub is the subject, usually a user ID. exp, iat and nbf are expiry, issued-at and not-before, in seconds since the Unix epoch, as defined in RFC 7519 section 4.1. A token that is rejected as expired a few seconds early usually means the clocks on two servers disagree.
The sample token
The token filled in by default is signed with HS256 and expires at 2026-01-01T01:00:00Z, one hour after it was issued.