JWT Decoder
Paste a JSON Web Token to read its header and claims, and see when it was issued and when it expires. The token never leaves your browser.
Nothing leaves your browser
How it works
- 1Paste a tokenThe whole eyJ… string, with or without the Bearer prefix.
- 2Read the claimsHeader and payload are shown as formatted JSON.
- 3Check the datesIssued, not-before and expiry times are shown in your time zone.
Questions
Is my text sent anywhere?
No. The token is decoded by code running in this page and is never sent anywhere, logged or saved. Even so, treat live tokens like passwords and prefer expired or test tokens when you can.
Does this check the signature?
No. Decoding only reads what the token says. Anyone can create a token with any claims, so your server must always verify the signature with the right key before trusting it.
Why can't it read my token?
A JWT has three Base64URL parts separated by dots. Encrypted tokens (JWE) have five parts and can only be read with the decryption key.