How to decode a JWT
- 1Paste the token. A leading “Bearer ” is removed automatically.
- 2Read the header and payload as formatted JSON.
- 3Check Time claims to see whether the token has expired or isn’t valid yet.
How a JWT is built
A JWT is three Base64url strings joined by dots. The header and payload are JSON; the signature is binary and can only be checked with the issuer’s key.
HeaderToken type and signing algorithm, such as HS256 or RS256.
PayloadClaims about the user and the token itself.
SignatureProves the first two parts weren’t changed.
Registered claims
issIssuer: who created the tokensubSubject: usually the user IDaudAudience: the service the token is meant forexpExpiration time, in seconds since 1970nbfNot before: the token is invalid until this timeiatIssued atjtiJWT ID: a unique identifier for the tokenFrequently asked questions
Is it safe to paste a real token here?
The token is decoded in your browser and isn’t sent anywhere. Still treat live tokens like passwords and avoid pasting them into tools you don’t trust.
Why isn’t the signature verified?
Verification needs the issuer’s secret or public key. Decoding only shows what the token claims; never trust those claims on a server without verifying the signature.
Is a JWT encrypted?
A standard signed JWT is not. Anyone with the token can read its payload, which is just Base64url-encoded JSON. Don’t put secrets in it.
Which time zone are the dates in?
Your device’s local time zone. The raw values in the payload are Unix timestamps in UTC seconds.