JWT Decoder
Find out why an access or ID token is being rejected. The decoder expands the header (algorithm) and payload (claims) as JSON and converts exp, iat and nbf to dates in your time zone and UTC, so you can see at a glance whether the token has expired.
A leading Bearer is fine. The token stays in your browser; it is never uploaded or stored.
Paste a string and the result appears here.
Other possible interpretations
Anatomy of a JWT
A JSON Web Token (RFC 7519) is three Base64url parts separated by dots: header.payload.signature. The header and payload are plain JSON, so anyone can read them. A JWT is signed, not encrypted, which is why secrets such as passwords must never be placed in the payload.
The signature is produced with a shared secret (HS256) or a private key (RS256, ES256) and lets the server detect tampering. This tool does not have the key, so it does not verify the signature.
| Part | Contents | Example |
|---|---|---|
| Header | Signing algorithm alg, type typ, key ID kid | {"alg":"RS256","typ":"JWT","kid":"abc"} |
| Payload | Claims: registered ones plus whatever the issuer adds | {"sub":"user1","exp":1793500000,"role":"admin"} |
| Signature | Signature over the first two parts | SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c |
Registered claims and how to read the times
exp(expiration),iat(issued at) andnbf(not before) are Unix time in seconds, not milliseconds. A 13-digit value is a bug and most servers will reject it. The decoder shows each as a local date, UTC and "in 2 hours" / "3 days ago".iss(issuer),aud(audience),sub(subject),jti(token ID) andscopeare what servers validate. A 401 usually meansauddoes not match your API orexpis in the past.- Clock skew between machines can make a freshly issued token fail its
nbfcheck; libraries typically allow a leeway of a minute or so. - For any other epoch value use the Unix timestamp converter.
Security notes
alg: nonemeans the token is unsigned. A server that accepts it can be fooled by anyone; always pin the allowed algorithms in your JWT library.- Short or guessable HS256 secrets can be brute-forced offline. Public-facing services should prefer asymmetric signatures (RS256, ES256, EdDSA).
- A JWE (five dot-separated parts) has an encrypted payload and cannot be opened here.
- A pasted token is a live credential. Keep it out of chats and issue trackers; this page sends nothing to a server. If the token is for your account but you did not obtain it yourself, it is circulating elsewhere: revoke it and issue a new one.
FAQ
Can it verify the signature?
No. Verification requires the issuer's secret or public key (JWKS). This tool decodes the contents and reports the signature length only.
Non-ASCII names in the payload look broken on another site.
JWT payloads are UTF-8 JSON. Tools that decode Base64 byte-by-byte into characters mangle accents, Cyrillic, CJK and emoji. This decoder uses proper UTF-8 decoding. Text that is already garbled can often be repaired with the mojibake fixer.
What about strings that are not JWTs?
The universal string decoder auto-detects Base64, URL encoding, hex, timestamps and more.
Sources
Found this useful? Share it
Only the page link is shared. Your inputs and files are never included.