JWT Decoder

What a JWT holds

A JWT has three parts separated by dots. The first part is the header, which names the algorithm in alg and the token type in typ. The second part is the payload, which holds the claims, such as the subject in sub, the issue time in iat, and the expiry time in exp. Both parts are JSON, encoded with base64url. The third part is the signature.

Decoding reads the first two parts. It needs no key, because the header and payload are encoded, not encrypted.

Key features

The decoder shows what you need to debug a login or an API call.

• The header and payload as one formatted JSON object.
• The algorithm from the header, such as HS256 or RS256.
• The exp claim as a UTC date, and whether the token has expired.
• A token with the Bearer prefix, copied from an Authorization header, is accepted.
• Large numeric claims keep their exact digits.
• A note above the result says that the signature is not checked.

How to decode a JWT

Decode in the box on this page. Tokens are short, so the 512 KB limit of the box does not matter here.

1. Paste the token into the box labeled "Paste your JWT", or select "Try an example".
2. Read the summary. It names the algorithm and the expiry.
3. Read the header and payload in the result panel.
4. Select Copy to copy the decoded JSON, or "Open in full editor" to browse it in the Tree view.

Worked example: an expired session token

The example token is signed with HS256 for a user named Ada Lovelace. The block below is the result from the box.

The summary reads "Algorithm HS256. Expired Jan 1, 2026, 01:00 UTC." The exp claim is 1767229200 seconds since 1970, which is one hour after iat. The signature part was not checked.

{
  "header": {
    "alg": "HS256",
    "typ": "JWT"
  },
  "payload": {
    "sub": "user_42",
    "name": "Ada Lovelace",
    "role": "admin",
    "iat": 1767225600,
    "exp": 1767229200
  }
}

Decoding is not verifying

Anyone who has a token can decode it. A server must check the signature with the secret or the public key before it trusts any claim. This tool does not have your key, so it does not check signatures, and it says so above every result.

Treat a live token like a password. Prettify does not send it anywhere, but a decoded token still shows who it belongs to and what it allows.

Tokens inside documents

When a JSON document holds a token, such as an API response with an access_token field, the Tree view in the editor marks the value as a JWT. Decode it in place to see the header, the payload, and the iat, nbf, and exp times as dates. This needs Smart value previews, which is on by default in Settings.

Common claims

RFC 7519 registers seven claim names. Most tokens use some of them next to claims that the issuer defines, such as name or role.

• iss: the issuer, the service that made the token.
• sub: the subject, usually the user ID.
• aud: the audience, the service the token is for.
• exp: the expiry time, in seconds since 1970.
• nbf: the time before which the token is not valid.
• iat: the time the token was issued.
• jti: a unique ID for the token.

Frequently asked questions

Related tools