How to decode a JWT
- Copy the token from your Authorization header, a cookie or your auth library. A leading Bearer prefix is fine.
- Paste it into the box. The header, payload and signature appear right away.
- Check the time claims. exp is when the token stops being valid, iat is when it was issued and nbf is the earliest time it is valid.
- Decoding does not verify the token. Anyone can read a JWT, and only the secret or public key shows it was not changed.
Example: the jwt.io sample token
Press Load sample, or paste this token:
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5cThe header is {"alg":"HS256","typ":"JWT"}. The payload holds sub, name and iat (January 18, 2018).
It has no exp claim, so the tool shows a "No exp claim" badge.
Frequently asked questions
Is it safe to paste my token here?
Decoding runs in your browser and nothing is uploaded. A live production token still works like a password for anyone who holds it until it expires, so use a token from a test environment when you can.
Does this verify the signature?
No. It only decodes. The payload shows what the token claims, and only signature verification shows those claims are genuine.
Why can I read the payload without a key?
A signed JWT (JWS) only base64url-encodes its header and payload, so anyone can read them. Keep secrets out of the payload.
What is a token with 5 parts?
That is an encrypted JWT (JWE). Its payload is encrypted, so it cannot be decoded without the key.
Why does exp show a different time than my server logs?
exp is a Unix timestamp in seconds, and this page shows it in your local time zone. Compare it with the UTC time in your logs.