JWT Decoder

About the JWT Decoder

A JSON Web Token is three Base64URL segments joined by dots: header, payload and signature. The decoder splits the token, decodes the first two segments into readable JSON and shows the signature as raw text.

Decoding is not verifying. The tool does not check the signature, so a decoded token is not proof that it is genuine or unmodified.

How to use it

1. Paste the token (three parts separated by dots) into the input box, or press Load Sample JWT.
2. Read the decoded header and payload, and the expiry badge if the token has an exp claim.
3. Use the copy buttons to take the header or payload as JSON.

Worked example

The widely used sample token from the JWT documentation; the tool shows each part in its own panel.

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

Header:  {"alg":"HS256","typ":"JWT"}
Payload: {"sub":"1234567890","name":"John Doe","iat":1516239022}
Signature: SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

Common mistakes and gotchas

• A token must have exactly three dot-separated parts. Two parts usually means the signature was cut off when copying; five parts is a JWE (encrypted token), which cannot be decoded without the key.
• Never trust claims you have only decoded. Verify the signature, issuer, audience and expiry on your server with the real key.
• The exp, iat and nbf claims are Unix timestamps in seconds, not milliseconds. The expiry badge compares exp with your device clock, so a wrong system clock gives a wrong answer.
• A pasted Authorization header value that starts with Bearer is accepted; the prefix is ignored.

Frequently asked questions