Developer Tools

JWT Decoder

Decode a JSON Web Token to read its header, payload and expiry time.

Runs in your browser: nothing you enter is uploaded

How it works

1

Paste the token

Paste a JWT, with or without "Bearer" in front.

2

Read the parts

See the header and payload as formatted JSON.

3

Check the dates

Expiry, issued at and not before are shown as normal dates, with a clear expired or valid label.

JWT Decoder features

  • Decodes header and payload instantly.
  • Shows if the token is expired or not yet valid.
  • Turns iat, exp and nbf into readable dates.
  • Explains common claims like iss, sub and aud.
  • Works with Bearer tokens from API calls.
  • Private: decoded in your browser.

JWT Decoder FAQ

What is a JWT?

A JSON Web Token is a compact, signed piece of data used to prove who you are to an API. It has a header, a payload and a signature.

Can you check the signature?

No. Checking the signature needs the secret or public key, which should never be pasted into a website.

Is it safe to paste my token here?

The token is decoded in your browser and not sent anywhere. Still, avoid pasting tokens for live accounts into sites you do not trust.

Why does it say expired?

The exp time in the payload is in the past, so APIs will reject the token. Sign in again to get a new one.

Related Developer Tools

Recent from the blog