JWT Decoder
Read the header and payload of a JSON Web Token, see its claims explained and its times as dates. It does not check the signature.
Paste a token, then press Decode.
Ctrl or ⌘ + Enter decodes.
Signature not verified. This tool reads a token. It does not check the signature, the issuer or the algorithm, so a token that decodes here may still be forged, altered or expired. Everything shown is what the token says about itself.
Paste a token, or load the example.
The text in the box changed after this was decoded. Press Decode to update.
This could not be read as a JWT
Decoded token
Structure
Header
Payload
Registered claims
The payload has none of the registered claims (iss, sub, aud, exp, nbf, iat, jti).
Times
Signature: not verified
The decoded content is untrusted data. Anyone can write a token that decodes to anything. Do not act on it, follow addresses in it or treat it as proof of who someone is until a system that holds the right key has verified it.
How to Use the JWT Decoder
-
Paste a token into the box, or load the example. A token
is three parts joined by dots, and often starts with
eyJ. - Press Decode. The header and payload appear as readable JSON, with the registered claims explained and the times shown as dates.
- If the text cannot be read, the message says which part is wrong and where.
- Copy header or Copy payload copies only the decoded JSON, and only when you press it.
Decoding Is Not Verifying
The header and payload of a JWT are not encrypted. They are encoded with base64url, which anyone can reverse, so a decoder can show them without any key. What proves a token genuine is its signature, and only a system that holds the right key can check it. This tool never does.
Treat every value as a claim the token makes about itself,
including alg, typ and
kid in the header. A token can say it was
issued by anyone, for anyone, until the signature is checked
by the service that is supposed to accept it.
A token whose header says "alg":"none" declares
that it has no signature. The tool reports that fact and
nothing more.
What It Reads
A signed token with three dot-separated parts, whose first
two parts are base64url-encoded UTF-8 text holding a JSON
object. A leading Bearer and any spaces or line
breaks are ignored, and the tool says so when it does.
An encrypted token (five parts) is recognised and refused, because its contents cannot be read without a key. A payload that is not a JSON object is refused too. The tool works on up to 100,000 characters.
The JSON is shown exactly as written in the token, so a number is never rounded or reformatted. A repeated key and an integer larger than JavaScript can hold are shown as notes.
Reading exp, nbf and iat
These claims are a count of seconds since 1 January 1970 UTC. The tool shows each as UTC, in the time zone of this device, and as a time from now. If a number is so large that it looks like milliseconds, it says so but does not convert it.
The status lines compare the time with the clock of this device. They describe the numbers; they do not say whether a token is accepted, because the service that checks it uses its own clock and may allow some leeway. To read other timestamps, use the Unix Timestamp Converter.
Common Uses
- Seeing which claims an identity provider put in a token while you debug a login.
- Checking when a token was issued and when it says it expires.
- Reading a token from a log or a support ticket without sending it to another site.
The payload is JSON. To check or reformat other JSON, use the JSON Formatter & Validator.
JWT Decoder FAQ
Is my token sent anywhere?
No. The token is decoded by code running in your browser, and it is not uploaded, stored or put in the page address. Reloading the page clears it. ToolZen Hub cannot control browser extensions, the clipboard history of your device or other software you have installed, so treat a live token like a password and prefer an expired or test token when you can.
Does this tell me if a token is valid?
No. It only reads what the token says. Whether it is genuine, unaltered and still accepted is decided by the service that checks the signature with the right key.
Why does it say the token is not a JWT?
A signed JWT has exactly three parts. Many tokens that look similar are not JWTs: opaque access tokens, session identifiers and encrypted tokens do not decode to JSON. The message names what the tool found.
Why is the expiry in a different time zone from my server logs?
The claim itself has no time zone. It is a count of seconds from a fixed UTC moment. The tool shows that moment in UTC and in this device's zone so you can match either one.
Can it verify a signature or create a token?
No. It has no key input, no signing and no verification, by design.