Header
Free · Instant · No signup
JWT Decoder
Inspect header, payload, and exp/nbf against this device clock. Signatures stay unverified. Nothing is uploaded.
JWT Decoder
Decoder
Calculated Results
No token
Paste a token to inspect header, payload, and claims.
Payload
Signature status
Waiting for a token.
Claims inspector
| Claim | UNIX | ISO 8601 | Relative |
|---|---|---|---|
| No exp, nbf, or iat claims yet. | |||
Read a JWT without sending it to jwt.io
A JSON Web Token is three base64url segments: header, payload, signature. The payload is often a bag of claims (sub, iss, aud, exp, nbf, iat) that you need to read while debugging an API 401. Pasting that token into a hosted debugger uploads a bearer credential. This page decodes in the tab. Header is the rose card. Payload is the violet card. Signature status is the sky card.
The live badge uses this device clock. nbf in the future: NOT YET VALID. exp in the past: EXPIRED. Otherwise ACTIVE. Missing exp is still ACTIVE with a note that this page cannot bound lifetime. The claims table converts UNIX seconds for exp, nbf, and iat to ISO 8601 UTC and a relative phrase such as "Expires in 2 hours, 15 minutes".
header.payload.signatureexp, nbf, iat as UNIX secondsalg none = unsigned
Wrong field counts (not two dots) raise an assertive alert. A truncated token with no signature segment still attempts header and payload decode and labels the signature as missing. Encrypted JWE (five segments, enc in the header) is rejected as the wrong format for this inspector.
alg none and unverified signatures
If alg is none, the page warns explicitly. Historical library bugs treated none as a valid verify result. Do not ship that. HS256/RS256 tokens on this page still show "not verified in the browser" because verification needs a key you should not paste here. Use your API gateway or a local CLI for that step.
Load sample JWT builds a demo HS256-shaped token with iat, nbf, and exp relative to now so the badge reads ACTIVE. The signature string is a placeholder. Clear wipes the textarea. For raw base64url work that is not a JWT, use the Base64 Encoder and Decoder.
Clock skew: if your laptop is five minutes fast, a token that is still valid on the server can show EXPIRED here. Compare ISO timestamps, not only the badge. exp is usually seconds, not milliseconds. Values like 1690000000000 will format as a date in the year 55000 and are almost certainly milliseconds pasted by mistake.
What belongs in the payload card
Anything JSON.parse accepts after base64url decode. Nested objects pretty-print with two-space indent. This is not a claims validator against your issuer's schema. Role names, tenant IDs, and email addresses in the payload are visible to anyone who can read the token, signature or not. That is how JWT works: the payload is encoded, not encrypted.
If you need to pretty-print a JSON body that is not a JWT, use the JSON Formatter and Minifier. If you are debugging a scheduled job rather than a token, use the Cron Expression Generator.
Frequently Asked Questions (FAQ)
Does this tool verify the JWT signature?
No. The browser does not have your HMAC secret or RSA public key in a trustworthy way on this page. The signature card reports whether a third segment is present and which alg/typ the header claims. Confirm signatures on a server. alg none is called out as unsigned.
What format is required?
Compact serialization: header.payload.signature with two dots and three base64url segments. Two segments (missing signature) are decoded as truncated or unsigned. One segment, extra dots, or non-JSON header/payload raise a live alert. Encrypted JWE is not supported.
How are ACTIVE, EXPIRED, and NOT YET VALID decided?
Compared to this device clock. If nbf is in the future: NOT YET VALID. Else if exp is in the past: EXPIRED. Else ACTIVE. Missing exp is still ACTIVE, with a note that lifetime is unbounded on this page. UNIX claims are also shown as ISO 8601 UTC and relative time.
Why warn when alg is none?
RFC 7519 allows alg none, which means no signature. Many libraries have treated that as verified. If the header says none, this page shows an assertive alert: do not use the token for authentication. Anyone who can mint the payload can impersonate the subject.
Related tools
- Base64 Encoder & Decoder UTF-8 and emoji-safe encode/decode, Standard or URL-safe, with byte telemetry.
- JSON Formatter and Minifier 2-space, 4-space, tab, or compact JSON with auto-fix and line/column errors.
- Cron Expression Generator 5-field crontab builder, English explanation, and next 5 local run times.
- Regex Tester JavaScript regex flags, match table with groups, presets, and a 20k ReDoS cap.