Paste a JSON Web Token to read its header and claims. Times are shown as dates, an expired token is flagged, and the token never leaves your browser.
Runs entirely in your browser — nothing you enter here is sent to a server.
A JSON Web Token is three Base64URL-encoded pieces joined by dots. The header names the signing algorithm. The payload is a JSON object of claims — statements such as who the user is, who issued the token and when it expires. The signature is computed over the first two parts with a key, so the receiver can tell whether anything was altered.
The point to remember is that the header and payload are encoded, not encrypted. Anyone who holds a token can read everything in it, exactly as this page does. The signature stops a token being changed; it does nothing to stop it being read. Passwords, card numbers and other secrets must never be put in a JWT.
exp, iat, nbfExpiry, issue time and "not before", as Unix timestamps in seconds. A server must reject a token past its exp.
iss and audWho issued the token and which service it is meant for. Checking both stops a token for one API being replayed against another.
subThe subject — normally the user id. This is what the application uses to decide whose data to return.
algHS256 uses one shared secret; RS256 and ES256 use a private key to sign and a public key to verify. Never accept none.
Most "401 Unauthorized" mysteries end at one of four claims. The token has expired — compare exp with the current time, and allow for clock drift between servers. The audience does not match what the API expects. The issuer is a different environment: a staging token sent to production. Or the scope lacks the permission the endpoint needs. Decoding the token answers all four in seconds.
A token is a credential: whoever has it can act as the user until it expires. That is why this decoder works entirely in your browser — and why you should think twice before pasting a production token into any online tool that does not.
Only if the decoding happens in your browser, as it does here — nothing is sent to a server. A live token is a working credential, so avoid any tool that uploads it, and prefer expired or test tokens when you can.
Yes. The payload is Base64URL-encoded, not encrypted, so anyone holding the token can read its claims. The signature only protects against modification.
Look at the exp claim: it is a Unix timestamp in seconds. If it is earlier than the current time, the token is expired. The decoder converts it to a date and shows how long ago that was.
No. Verification needs the secret or public key and belongs on your server. Decoding shows what the token claims; it does not prove the claims are true.
Upzilla checks your sites, servers and APIs around the clock and alerts you the moment something breaks. 10 monitors free, no card required.