How to decode a JWT
- Paste the token, with or without the word Bearer.
- Read the decoded header and payload.
- Check the issued and expiry times in your time zone.
How a JWT is built
A token is header.payload.signature. The header and payload are JSON encoded in Base64URL; the signature is computed over them with a secret (HS256) or a private key (RS256, ES256).
Debugging authentication
Decoding shows whether a token has expired, which audience (aud) and issuer (iss) it was made for, and which roles or scopes it carries β the usual causes of 401 and 403 errors.
Keep secrets out of tokens
Anyone holding a JWT can read its payload, so never put passwords or personal data in it. Keep tokens short-lived and store them where scripts on other sites cannot read them.
Frequently asked questions
Is it safe to paste my token here?
Decoding runs entirely in your browser and nothing is sent or stored. Still, treat production tokens like passwords and prefer test tokens.
What is inside a JWT?
A header with the signing algorithm, a payload with claims such as the user ID, issue and expiry times, and a signature. Header and payload are only Base64URL-encoded, not encrypted.
Why can't you verify the signature?
Verification needs the secret or public key, which should stay on your server. This tool only reads the token.
What do iat, nbf and exp mean?
Issued at, not before and expiration time, each as a Unix timestamp in seconds.