Why does my JWT show as expired?

The exp claim contains a Unix timestamp of when the token expires. If this is in the past, the token is expired.

What are registered claims?

Registered claims are predefined in the JWT spec: iss, sub, aud, exp, nbf, iat, and jti.

Can I decode encrypted JWTs (JWE)?

This tool is designed for signed JWTs (JWS), not encrypted JWTs. Encrypted tokens require the decryption key.

100% Client-Side

JWT Token Decoder

Decode and inspect JSON Web Tokens (JWTs) instantly in your browser. View the header, payload, and signature of any JWT without sending your tokens to a server. Perfect for debugging authentication flows and understanding token contents.

Open JWT Decoder

Key Features

🔓

Instant Decoding

Paste any JWT and immediately see its decoded header and payload in a readable JSON format.

📊

Claim Analysis

Identify standard claims like expiration (exp), issued at (iat), subject (sub), and custom claims.

⏰

Expiration Check

Instantly see if a token is expired with human-readable timestamp conversion.

🔒

Privacy-First

Tokens are decoded locally in your browser. Nothing is sent to any server.

🔤

Algorithm Detection

Identify the signing algorithm (HS256, RS256, ES256, etc.) used to create the token.

📋

Easy Copying

Copy decoded JSON or individual claims with a single click for use in your applications.

Understanding JWT Structure

A JWT consists of three parts separated by dots (.) Each part is Base64URL encoded:

Anatomy of a JWT Token

Header

Contains metadata about the token, including the signing algorithm (alg) and token type (typ). Example: {"alg": "HS256", "typ": "JWT"}

Payload

Contains the claims - statements about the user and additional data. Includes registered claims (iss, sub, exp) and custom claims specific to your application.

Signature

Created by signing the encoded header and payload with a secret key. Used to verify the token hasn't been tampered with and was issued by a trusted source.

How to Use

Paste Your JWT

Copy a JWT from your application, API response, browser storage, or authentication header and paste it into the decoder.

View Decoded Content

The tool instantly decodes and displays the header and payload as formatted JSON. Timestamps are converted to readable dates.

Analyze and Debug

Check expiration times, verify claims, identify the signing algorithm, and copy specific values as needed.

⚠️ Security Reminder

This tool only decodes JWTs - it doesn't verify signatures. Never trust the contents of a JWT without verifying its signature with the appropriate secret or public key on your server. Anyone can create a JWT with any claims; the signature is what proves authenticity.

Common Use Cases

Authentication Debugging

Debug OAuth and authentication flows by inspecting access tokens and ID tokens.

API Development

Verify that your API is generating tokens with the correct claims and expiration times.

Session Analysis

Understand what user data is stored in session tokens and how long sessions last.

Security Auditing

Review what information is exposed in tokens and ensure sensitive data isn't included.

Learning JWTs

Explore how JWTs work by decoding example tokens and understanding their structure.

Troubleshooting Expiration

Quickly check if authentication failures are caused by expired tokens.

Frequently Asked Questions

Yes, our JWT decoder processes everything in your browser. Your tokens are never sent to our servers. However, be cautious about pasting production tokens into any online tool - even client-side ones. For maximum security with sensitive tokens, use local command-line tools.

This tool only decodes JWTs; it doesn't verify signatures. Signature verification requires either the secret key (for HMAC algorithms) or public key (for RSA/ECDSA algorithms), which should never be shared with third-party tools. Always verify signatures on your own server before trusting JWT contents.

The decoder can read JWTs signed with any algorithm since decoding doesn't require the signing key. It will display the algorithm used (HS256, RS256, ES256, PS256, etc.) from the token header. This helps you understand which verification method the token requires.

The "exp" claim contains a Unix timestamp of when the token expires. If this timestamp is in the past relative to your current time, the token is expired. Note that clock skew between your device and the server that issued the token can sometimes cause timing issues.

Registered claims are predefined claims in the JWT specification: iss (issuer), sub (subject), aud (audience), exp (expiration time), nbf (not before), iat (issued at), and jti (JWT ID). These have standard meanings, though not all tokens use all claims.

This tool is designed for signed JWTs (JWS), not encrypted JWTs (JWE). Encrypted tokens require the decryption key to view the contents. If you paste a JWE, the tool will show the header but cannot decrypt the payload.

Known limitations

— This tool decodes JWTs — it doesn't verify signatures. To actually verify a token's signature you need the secret or public key; that's something to do in your backend, not here.
— Nested JWTs (tokens within tokens) aren't automatically unwrapped — you'll need to decode the inner token separately.
— Tokens with non-UTF8 binary payloads may display garbled characters. Most real-world JWTs are fine; this mostly affects edge cases with custom claim types.