Skip to content
HTMLSuite
Menu

JWT Decoder

This JWT decoder shows a token's header, payload and expiry. Nothing is sent anywhere.

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkFkYSBMb3ZlbGFjZSIsInJvbGUiOiJhZG1pbiIsImlhdCI6MTc5MTUwNDAwMCwiZXhwIjoxODkzNDU2MDAwfQ.MFlNF1P2GuaAXg9rKVcFDRXQswunY7TemdD37ueZVtc

Verify signature (optional)

Header

{
  "alg": "HS256",
  "typ": "JWT"
}

Payload

{
  "sub": "1234567890",
  "name": "Ada Lovelace",
  "role": "admin",
  "iat": 1791504000,
  "exp": 1893456000
}

Decoding is not verification: anyone can read and rewrite a JWT’s header and payload. Only a valid signature proves the token is genuine.

How to decode a JWT

  1. Paste the token on the left. A leading Bearer from an Authorization header is removed automatically.
  2. The header and payload appear as formatted JSON, and the time claims are shown as dates with a clear “expired” or “valid for” status.
  3. Optional: for HS256, HS384 or HS512 tokens, enter the secret and press Verify to check the signature. The sample token's secret is htmlsuite-demo-secret.

The three parts of a JWT

A JSON Web Token (RFC 7519) is three Base64url strings joined by dots. The header names the signing algorithm, the payload holds the claims — who the token is for, what it allows, when it expires — and the signature protects both against changes.

header.payload.signature
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9   → {"alg":"HS256","typ":"JWT"}
.eyJzdWIiOiIxMjM0NTY3ODkwIiwi…        → {"sub":"1234567890", …}
.MFlNF1P2GuaAXg9rKVcFDRXQswunY7Te…    → HMAC-SHA256 signature

Common claims explained

  • exp (expiration), iat (issued at) and nbf (not before): Unix timestamps in seconds, shown here as local dates.
  • sub: the subject, usually a user ID. iss: who issued the token. aud: who it is meant for.
  • jti: a unique token ID, used to prevent replay. Everything else is a custom claim defined by the application.

Decoding is not verification

Anyone can decode a JWT — the payload is encoded, not encrypted. Never put secrets in it, and never trust a decoded token on its own: your server must verify the signature with the right key and check exp before using any claim. This page reads the token entirely in your browser; it is not sent, logged or stored anywhere.

Related developer tools

Decode a single Base64url part with the Base64 decoder, format a large payload in the JSON formatter, or create unique jti values with the UUID generator. To check any other epoch value, use the Unix timestamp converter; tokens copied from a callback URL may first need the URL decoder.

Frequently asked questions

Does decoding a JWT verify it?
No. The header and payload are only Base64url-encoded, so anyone can read — and change — them. A token is trustworthy only if its signature checks out with the right key. Decoding is for reading and debugging.
Is it safe to paste my token here?
The token is decoded in your browser and never sent anywhere. Still, treat live tokens like passwords: anyone who has one can use it until it expires.
What do exp, iat and nbf mean?
They are times in seconds since 1 January 1970 (Unix time). exp is when the token expires, iat when it was issued, and nbf the time before which it must not be accepted. The decoder shows them as dates and tells you whether the token is still valid.
Can I check the signature?
For HS256, HS384 and HS512 tokens, enter the shared secret and press Verify; the check uses your browser’s Web Crypto API. RS256, ES256 and other public-key algorithms need the issuer’s public key and aren’t checked here.
Why does my token fail to decode?
A signed JWT has exactly three parts separated by dots. Common problems are a missing part from incomplete copying, extra quotes, or an encrypted token (JWE) with five parts, which can’t be read without the key.

Related tools