How to decode a JWT token
- Paste the token and the JWT decode runs as you type. A full
Authorization: Bearer eyJ…header works too: the prefix is removed for you, which makes it a quick bearer token decoder. - Read the header (algorithm, type, key ID) and the payload claims, each formatted and ready to copy. The JWT parser checks that every part is valid Base64URL and JSON, so a mistyped token is reported instead of half-decoded.
- Check the status badge and the time claims table to see when the token was issued and when it expires, in UTC and relative to now.
- Look at any warnings: an
algofnone, time claims in milliseconds instead of seconds, or the wrong Base64 alphabet.
The three parts of a JWT
A signed JWT uses the JWS compact format from RFC 7515: header.payload.signature, each part encoded with Base64URL without padding.
eyJhbGciOiJIUzI1NiJ9 . eyJzdWIiOiIxMjMifQ . 3q2-7zk…
└──── header ──────┘ └─── payload ───┘ └ signature ┘
{"alg":"HS256"} {"sub":"123"} HMAC or RSA/ECDSA bytesThe signature is computed over the first two parts, so changing a single character of the header or payload makes it invalid. A token with five parts is a JWE: its payload is encrypted and cannot be decoded without the key, so this tool reports that instead of guessing.
Registered claims
RFC 7519, section 4.1 defines a small set of standard claim names. All are optional, and applications add their own claims, such as name, email or scope, alongside them.
| Claim | Meaning |
|---|---|
iss | Issuer: who created the token |
sub | Subject: the user or entity the token is about |
aud | Audience: who the token is meant for |
exp | Expiration time |
nbf | Not valid before |
iat | Issued at |
jti | JWT ID: unique identifier |
exp, nbf and iat are NumericDate values: seconds since the Unix epoch, not milliseconds. The epoch converter turns any of them into a date. A token is expired when the current time is at or after exp; servers often allow a minute or two of clock skew.
Decode vs. verify, and “JWT decrypt”
Decoding is reading; verifying is proving the token came from the issuer and was not changed. Verification needs the shared secret (for HS256) or the issuer's public key (for RS256, ES256 and similar) and should happen on your server with a maintained JWT library, which also checks exp, aud and iss. People sometimes search for a “JWT decrypt” tool, but a normal signed JWT is not encrypted at all: its payload is just Base64URL text that the Base64 decoder can read too. Only JWE tokens are encrypted.
Because the payload is readable by anyone holding the token, never put passwords or other secrets in JWT claims, and treat tokens themselves as secrets. This JWT debugger runs entirely in your browser and sends nothing, but production tokens are still best inspected with local tools.