Free tool · runs in your browser
JWT decoder
Paste a JSON Web Token to read its header and payload, and see when it was issued and when it expires.
Quick answer
A JWT has three parts separated by dots: a header, a payload and a signature. The first two are Base64URL-encoded JSON, so anyone can decode and read them; only the signature proves the token is genuine. This tool decodes the header and payload and turns exp, iat and nbf into readable dates. It does not verify the signature.
How to use it
- Paste the token. Copy the JWT from your app, an Authorization header or a cookie, and paste it into the box.
- Read the parts. The header shows the algorithm; the payload shows the claims, such as the user id and roles.
- Check the times. The tool shows when the token was issued and when it expires, and whether it has already expired.
Frequently asked questions
Is it safe to paste my JWT here?
Yes. Decoding happens entirely in your browser and nothing is sent to a server. Still, treat production tokens like passwords and avoid sharing them.
Does this tool verify the JWT signature?
No. Verifying a signature needs the secret or public key, which belongs on your server. Decoding only reads the header and payload.
Why can anyone read my JWT payload?
The payload is only encoded, not encrypted. Never put passwords or secrets in a JWT.
What do exp, iat and nbf mean?
exp is when the token expires, iat is when it was issued, and nbf is the time before which it is not valid. All are Unix timestamps in seconds.
Why do users get logged out at random with JWTs?
Usually refresh races between requests or tabs, clock differences, cookie settings or secrets that differ between servers. See the article on fixing JWT session bugs.
What is the difference between JWS and JWE?
A JWS is signed but readable, which is what most JWTs are. A JWE is encrypted, so its payload cannot be read without the key. This tool decodes signed tokens only.
What is the alg in the JWT header?
The signing algorithm, such as HS256 (a shared secret) or RS256 and ES256 (a private and public key pair). Servers should only accept the algorithms they expect.
How long should a JWT be valid?
Access tokens are usually short-lived, from minutes to an hour, with a longer-lived refresh token used to get new ones. Short tokens limit the damage if one leaks.
Where should a JWT be stored in the browser?
Many apps keep the refresh token in an httpOnly, Secure cookie and the short-lived access token in memory, which limits what a malicious script can read.
Can I edit the payload and reuse the token?
No. Changing any part invalidates the signature, and a correctly configured server rejects the token.