JWT Decoder
Decode JWT header and payload with readable exp/iat — signature is NOT verified.
About this tool
A JSON Web Token is three Base64URL segments joined by dots: a header, a payload of claims, and a signature. This tool decodes the header and payload and turns the exp, iat and nbf claims into readable dates, flagging expired tokens.
It does not verify the signature, so a decoded token is not proof that the token is genuine. Tokens with alg set to none are flagged as unsigned. Decoding runs in your browser; the token is never sent anywhere.
How to use it
- Paste the token, the three dot-separated parts starting with eyJ.
- Decode it.
- Read the header and payload as JSON. Time claims are shown as dates and an expired token is flagged.
Example
Input:
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5cHeader and payload:
{ "alg": "HS256", "typ": "JWT" }
{ "sub": "1234567890", "name": "John Doe", "iat": 1516239022 }
iat = 2018-01-18 01:30:22 UTC