JWT Decoder

Paste a JSON Web Token to see its header and payload as formatted JSON. Timestamps such as exp, iat and nbf are converted to readable dates, and expired tokens are flagged.

Structure of a JWT

A JWT has three parts separated by dots: header.payload.signature. The header and payload are JSON objects encoded with Base64URL without padding. The signature is computed over the first two parts with the algorithm named in the header (alg), for example HS256 or RS256.

Registered claims

ClaimMeaning
issIssuer
subSubject (usually the user ID)
audAudience
expExpiration time (seconds since 1970)
nbfNot valid before
iatIssued at
jtiUnique token ID

Decode a JWT in JavaScript

const [h, p] = token.split('.');
const json = (s) => JSON.parse(new TextDecoder().decode(
  Uint8Array.from(atob(s.replace(/-/g, '+').replace(/_/g, '/')), (c) => c.charCodeAt(0))));
console.log(json(h), json(p));

Frequently asked questions

Is it safe to paste my JWT here?

Decoding happens entirely in your browser; nothing is sent to a server. Still, treat production tokens as secrets.

Does decoding verify the signature?

No. Anyone can decode a JWT because it is only Base64URL. Verification requires the secret or public key and must be done by your server.

Related tools and guides

Comments (0)

Questions, ideas or a bug in “JWT Decoder”? Leave a comment, rate the tool, or reply to others.

No comments yet. Be the first to share your feedback!

Leave a comment

Rate this tool:
Esc
↑ ↓ move↵ openEsc close