Developer tools

JWT Decoder: Decode a JSON Web Token Online

Paste a JSON Web Token to see its header and payload as readable JSON, with the issued, not-before and expiry times shown as dates and whether it has expired. The token is decoded on your device and never sent anywhere.

The token is decoded on your device and never sent anywhere. The signature is not checked, so don’t trust these contents until your own server has verified the token.

How to use the JWT Decoder

  1. Paste your token (a leading "Bearer " is fine).
  2. Read the header, payload and time claims.
  3. Copy the parts you need.

Frequently asked questions

Is it safe to paste a real token here?
Decoding happens on your device and nothing is sent anywhere. Still, treat live tokens like passwords: anyone who has one may be able to use it until it expires.
Does this check the signature?
No. It only decodes the token. Anyone can create a token with any contents, so your server must verify the signature with its key before trusting it.
What do exp, iat and nbf mean?
exp is when the token expires, iat when it was issued and nbf the time before which it isn't valid. They're stored as Unix timestamps in seconds; this tool shows them as dates.
Why can't it read my token?
A signed JWT has three parts separated by dots. Encrypted tokens (five parts) can't be read without the key, and some services use tokens that aren't JWTs at all.