JWT decoder
Paste a JSON Web Token to read its header and claims and to see when it expires. It is decoded in your browser and never uploaded.
Ctrl or Cmd + Enter also decodes
Header
{
"alg": "HS256",
"typ": "JWT"
}Payload
{
"sub": "1234567890",
"name": "John Doe",
"iat": 1516239022
}Times
- Issued at
- 1/18/2018, 1:30:22 AM
- 9 years ago
The signature is not checked: this tool only reads the token. Anyone can read a JWT, only the holder of the key can prove it is genuine.
Good to know
- Is it safe to paste a real token?
- The token is decoded by JavaScript in this page and is never sent anywhere. Still, treat any live token like a password: prefer expired or test tokens, and revoke one you have shared by mistake.
- Does this verify the signature?
- No. Verifying needs the secret or public key, which belongs on your server. This tool only shows what the token claims.
- What are exp, iat and nbf?
- They are times in seconds since 1 January 1970 (UTC): when the token expires (exp), when it was issued (iat) and the earliest time it is valid (nbf).