WebTools

Developer Tools

JWT Decoder

Decode a JSON Web Token in your browser and see its claims, algorithm and expiry in IST and UTC.

By Nitin Raturi · Last reviewed

Input

How to use the JWT Decoder

Read what a JWT contains and whether its time claims are still valid.

  1. Paste a JWT into the box.
  2. Read the status: valid, expired, not yet valid, or no expiry.
  3. Check the header for the algorithm and the payload for the claims.
  4. Read exp, nbf and iat in both IST and UTC.

Good to know

  • Decoding is not verification: the signature is not checked here.
  • Tap the ⓘ next to the field for a short guide.

Decodes the header and payload of a JWT (RFC 7519). The signature is shown but not verified.

Runs in your browser. Nothing you type is uploaded or saved in the link.

JWT

A JSON Web Token: three base64url parts (header, payload and signature) joined by dots.

How to fill it in

  • Paste the whole token. A leading “Bearer ” is removed for you.
  • It is decoded in your browser and never uploaded or saved in the link.

Example

The sample token from RFC 7519 has an “exp” of 2011-03-23T00:13:00+05:30, so it shows as expired.

Keep in mind: Anyone holding a live token can use it. Prefer test tokens, and revoke any production token you have pasted anywhere.

Result

Expired

Expires (exp)
Wed, 23 Mar 2011, 00:13:00 IST · Tue, 22 Mar 2011, 18:43:00 UTC · 15 years 230 days ago

Header

{
  "typ": "JWT",
  "alg": "HS256"
}

Payload

{
  "iss": "joe",
  "exp": 1300819380,
  "http://example.com/is_root": true
}

Signature (not verified)

dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk

Algorithm
HS256

ChangelogHow we test this toolEmbed this tool

How this calculator works

  1. Step 1Split at the dots3 partsHeader, payload and signature.
  2. Step 2Decode base64urlHeader and payloadEach turns into a small JSON object.
  3. Step 3Check the timesexp, nbf, iatCompared with the current time, shown in IST and UTC.

A JSON Web Token (JWT) carries claims, such as who a user is and when access ends. Decoding shows those claims. It does not prove the token is genuine.

Worked example: the RFC 7519 sample token

The sample token says it expires at 2011-03-22T18:43:00Z, which is 2011-03-23T00:13:00+05:30 in India.

Decoding the RFC 7519 example
Token
eyJ0eXAiOiJKV1Qi… . eyJpc3MiOiJqb2Ui… . dBjftJeZ4CVP…
  1. Header: algorithmHS256
  2. Payload: issuer (iss)joe
  3. Payload: expiry (exp)1300819380
  4. exp in UTC2011-03-22T18:43:00Z
  5. StatusExpired

The “exp” value is a Unix time: seconds since 1 January 1970 UTC. The decoder converts it so you do not have to.

Reading the result

  • Decoding (this tool)Reads the claimsAnyone can do it; no key is needed.
  • Verifying (your server)Proves the tokenChecks the signature with the right key before trusting any claim.
  • alg is noneThe token is unsigned and should normally be rejected.
  • No exp claimThe token never expires on its own.
  • Five partsAn encrypted JWT (JWE) cannot be read without its key.
  • Timesexp, nbf and iat in IST, UTC and as a countdown.

Decoding a JWT shows its claims; it does not prove the token is genuine.

To read the timestamps in its claims, use the Unix timestamp converter. The JSON formatter tidies the payload, and the Base64 encoder and decoder handles the encoding.

Common mistakes

  • Mistake: Trusting claims because the token decodes.

    Instead: Verify the signature on the server first.

  • Mistake: Putting secrets or personal data in the payload.

    Instead: Anyone can read a JWT payload; keep it minimal.

  • Mistake: Pasting live production tokens into online tools.

    Instead: Use test tokens, and revoke any live token you have shared.

Read how we test our calculators, or browse more developer tools.

Frequently asked questions

Is my token sent anywhere?

No. It is decoded in your browser and is not uploaded or saved in the page link. Even so, avoid pasting live production tokens into any website.

Does this verify the signature?

No. Decoding only reads the header and payload, which anyone can do. Your server must verify the signature with the correct key before trusting any claim.

How is expiry decided?

A token is expired from the moment the current time reaches its “exp” value. It is not yet valid before its “nbf” value. No extra leeway is added.

What does “alg: none” mean?

The token is unsigned. Security guidance (RFC 8725) says servers should reject such tokens unless they deliberately accept unsigned ones.

Why can’t it read my five-part token?

A JWT with five parts is encrypted (JWE). Its contents can only be read with the decryption key.

Sources and methodology

The formulas are standard time-value-of-money results. We check every figure against golden values worked out independently, by closed form and by month-by-month simulation; see the methodology.

Written and maintained by Nitin Raturi, a software engineer (about the author). Last reviewed 27 Oct 2026; next review due by . Found an error? Tell us.

Changelog

  • : Initial release. Demand metrics remain unverified.

  • Base64 Encoder & Decoder

    Encode text or files to Base64 and decode it back, with UTF-8 and URL-safe support, entirely in your browser.

  • Unix Timestamp Converter

    Convert Unix timestamps to dates in IST and UTC, and dates back to timestamps, in seconds or milliseconds.

  • JSON Formatter & Validator

    Check JSON, see the exact line and column of any error, and format or minify it, all inside your browser.