Free tool · runs in your browser

JWT decoder

Paste a JSON Web Token to read its header and payload, and see when it was issued and when it expires.

JSON Web Token

Quick answer

A JWT has three parts separated by dots: a header, a payload and a signature. The first two are Base64URL-encoded JSON, so anyone can decode and read them; only the signature proves the token is genuine. This tool decodes the header and payload and turns exp, iat and nbf into readable dates. It does not verify the signature.

How to use it

Paste the token. Copy the JWT from your app, an Authorization header or a cookie, and paste it into the box.
Read the parts. The header shows the algorithm; the payload shows the claims, such as the user id and roles.
Check the times. The tool shows when the token was issued and when it expires, and whether it has already expired.

Example

A signed JWT for a user with the admin role, valid for one hour:

Input

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyXzQyIiwibmFtZSI6IlNhcmEgTGV2aSIsInJvbGUiOiJhZG1pbiIsImlhdCI6MTc5MzUyMDAwMCwiZXhwIjoxNzkzNTIzNjAwfQ.1R3nQ-xp3SDmEZSSr355txmajhu1r1JjO863Li_Cam0

Output

Header
{
  "alg": "HS256",
  "typ": "JWT"
}

Payload
{
  "sub": "user_42",
  "name": "Sara Levi",
  "role": "admin",
  "iat": 1793520000,
  "exp": 1793523600
}

Issued (iat):  2026-11-01T08:00:00Z
Expires (exp): 2026-11-01T09:00:00Z

Common errors and how to fix them

The token will not decode: Copy only the token. Remove the "Bearer " prefix, quotes and line breaks, and check that it has exactly two dots.
jwt expired (TokenExpiredError): The exp time has passed. Get a new access token with the refresh token; do not just make tokens last longer.
invalid signature: The token was signed with a different secret or key than the server uses, often because environments or servers have different secrets. Use the same key everywhere that verifies tokens.
jwt not active (NotBeforeError): The nbf time is still in the future, usually because the server clocks differ. Sync clocks with NTP or allow a few seconds of clock tolerance.

Frequently asked questions

Is it safe to paste my JWT here?

Yes. Decoding happens entirely in your browser and nothing is sent to a server. Still, treat production tokens like passwords and avoid sharing them.

Does this tool verify the JWT signature?

No. Verifying a signature needs the secret or public key, which belongs on your server. Decoding only reads the header and payload.

Why can anyone read my JWT payload?

The payload is only encoded, not encrypted. Never put passwords or secrets in a JWT.

What do exp, iat and nbf mean?

exp is when the token expires, iat is when it was issued, and nbf is the time before which it is not valid. All are Unix timestamps in seconds.

Why do users get logged out at random with JWTs?

Usually refresh races between requests or tabs, clock differences, cookie settings or secrets that differ between servers. See the article on fixing JWT session bugs.

What is the difference between JWS and JWE?

A JWS is signed but readable, which is what most JWTs are. A JWE is encrypted, so its payload cannot be read without the key. This tool decodes signed tokens only.

What is the alg in the JWT header?

The signing algorithm, such as HS256 (a shared secret) or RS256 and ES256 (a private and public key pair). Servers should only accept the algorithms they expect.

How long should a JWT be valid?

Access tokens are usually short-lived, from minutes to an hour, with a longer-lived refresh token used to get new ones. Short tokens limit the damage if one leaks.

Where should a JWT be stored in the browser?

Many apps keep the refresh token in an httpOnly, Secure cookie and the short-lived access token in memory, which limits what a malicious script can read.

Can I edit the payload and reuse the token?

No. Changing any part invalidates the signature, and a correctly configured server rejects the token.