Header:
{
"alg": "RS256",
"typ": "JWT"
}
Claims:
{
"iss": "https://auth.example.com",
"aud": "orders-api",
"sub": "user_123",
"scope": "read:products write:orders",
"iat": 1753920000,
"exp": 1848512000
}
Signature verification is not performed locally without a supplied verification key.JWT decoder
A JSON Web Token (JWT) is a compact, URL-safe token of three Base64url parts (header, payload, and signature) that carries claims about a user or client.
Decode a JWT's header and payload, read its claims, and flag expiry, issuer and audience problems. Free, and the token is never sent to a server.
Browser-sideNo accountCopy, download, or print
Last reviewed
Your inputs are saved as a draft in this browser only. Nothing is uploaded.
Result
Header:
{
"alg": "RS256",
"typ": "JWT"
}
Claims:
{
"iss": "https://auth.example.com",
"aud": "orders-api",
"sub": "user_123",
"scope": "read:products write:orders",
"iat": 1753920000,
"exp": 1848512000
}
Signature verification is not performed locally without a supplied verification key.Examples
Decode a header
The segment eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9 decodes to {"alg":"HS256","typ":"JWT"}: an HMAC SHA-256 signed JWT.
Read the expiry time
exp, iat and nbf are seconds since 1 January 1970 UTC. "exp": 1893456000 means the token expires at 00:00:00 UTC on 1 January 2030.
Audience mismatch
A token with "aud": "billing-api" checked against an expected audience of orders-api is flagged, because the API it was issued for is not the one receiving it.
Clock skew
With a 60-second skew allowance, a token whose exp passed 45 seconds ago is not flagged as expired; one that expired 61 seconds ago is.
Unsigned token
A header of {"alg":"none"} means the token has no signature. APIs should reject it.
Spot the token type
A JWT with three dot-separated parts is signed (JWS) and its payload is readable by anyone. A token with five parts is encrypted (JWE) and cannot be read without the key.
How to use it
- Paste a JWT into the token field.
- Review the decoded header and payload claims.
- Optionally set an expected issuer or audience to flag mismatches.
- Set a clock-skew allowance in seconds and check the expiry warning.
Questions
- Does this verify the token signature?
- No. It decodes the header and claims locally. Verifying the signature needs the secret (for HS256) or the issuer's public key (for RS256 and ES256), and should happen in your API.
- Is it safe to paste a token here?
- Decoding happens entirely in your browser and the token is not transmitted. A JWT is still a bearer credential, so prefer expired or test tokens and do not paste live production tokens into tools you do not trust.
- What do iss, sub, aud, exp, nbf, iat and jti mean?
- They are the registered claims from RFC 7519: issuer, subject (who the token is about), audience (who it is for), expiry time, not-before time, issued-at time, and a unique token ID.
- Is a JWT encrypted?
- A standard three-part JWT is signed, not encrypted: anyone can Base64url-decode the payload. Do not put secrets or personal data in it unless you use an encrypted JWE.
- Why does it warn that my token is expired?
- If the exp claim is earlier than the current time minus the clock-skew allowance, the token is flagged as expired. Check your device clock too, since the comparison uses it.
- What is the difference between HS256 and RS256?
- HS256 signs with a shared secret that both the issuer and the API know. RS256 signs with the issuer's private key, and APIs verify with the public key, so they never hold a secret that could mint tokens.
- Is my token sent to a server?
- No. Decoding happens entirely in your browser and the token is not transmitted.