JWT decoder
Inspect token headers and claims. Decoding does not verify the signature.
Enable JavaScript to use this interactive tool. Paste input, choose options, then copy or download the result, or save it to your notebook.
Example and common questions
Inspect the header, subject, issued-at time, and expiry of a fictional token. The signature below is a dummy. Reading the claims does not establish whether a real token is authentic or accepted by a service.
How to inspect JWT claims and expiry
- Paste a three-part compact JWT. Use a fictional token when demonstrating the tool.
- Run the decoder and inspect the header, payload, and labelled UTC claim times.
- Use your application’s trusted verification process to establish authenticity; this decoder does not fetch keys or verify signatures.
Inspect issued-at and expiry claims in a fictional token
eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJkZW1vIiwiaWF0IjoxNzA0MDY3MjAwLCJleHAiOjE3MDQwNzA4MDB9.ZGVtbw{
"warning": "Decoded only. Signature and authenticity NOT verified.",
"header": {
"alg": "HS256"
},
"payload": {
"sub": "demo",
"iat": 1704067200,
"exp": 1704070800
},
"claimTimesUTC": {
"iat": "2024-01-01T00:00:00.000Z",
"exp": "2024-01-01T01:00:00.000Z"
}
}Does decoding verify a token?
No. Decoding does not verify the signature, issuer, audience or authenticity. The tool does not fetch keys or establish that a token is valid.
What are iat, nbf and exp?
They are NumericDate claims for issued-at, not-before and expiration times. Numeric claims are displayed as UTC times without declaring the token valid; invalid NumericDate values are labelled as invalid.
Which token format works?
Use a three-part compact JWT with JSON objects in its header and payload. Encrypted five-part tokens are not supported.
Common errors and limitations
Check the three segments, Base64url encoding and JSON object shapes. Invalid NumericDate claims are marked in the decoded output. A successful decode still does not verify the signature.