header.payload.signature
JWT decoder
A JSON Web Token (JWT) is 3 Base64url parts separated by dots: header, payload and signature. Paste a token to read its claims and times; it is decoded here, not verified.
- iat 1700000000 = 2023-11-14 22:13:20 UTC
- exp 1700003600 = 2023-11-14 23:13:20 UTC
- HS256 = 32 B
The token stays in this tab and is not sent anywhere. A decoded token is not a trusted token: the signature is never checked here.
Scanned by 
NortonTM Safe Web
At a glance
- Price
- No charge
- Account
- None needed
- Standards
- RFC 7519 (JWT), RFC 7515 (JWS), RFC 7516 (JWE)
- Signature
- Not verified — the token is decoded only
- Times
- exp, nbf and iat shown in UTC and compared with your clock
- Upload
- None — the token stays in your browser tab
A sample token and common algorithms
The sample token on this page is signed with HMAC-SHA-256 over a throwaway key. The page decoded it to produce the first table.
| Claim | Value | Time (UTC) |
|---|---|---|
| iss | auth.example.com | — |
| sub | user-42 | — |
| aud | api | — |
| iat | 1700000000 | 2023-11-14 22:13:20 UTC |
| exp | 1700003600 | 2023-11-14 23:13:20 UTC |
| alg | Family | Hash | Signature size |
|---|---|---|---|
| HS256 | HMAC | SHA-256 | 32 B |
| HS512 | HMAC | SHA-512 | 64 B |
| RS256 | RSASSA-PKCS1-v1_5 | SHA-256 | 256 B (2048-bit key) |
| ES256 | ECDSA P-256 | SHA-256 | 64 B |
| ES512 | ECDSA P-521 | SHA-512 | 132 B |
| EdDSA | EdDSA | — | 64 B (Ed25519) |
How to decode a JWT
Paste the token
Paste the whole token, with or without a leading Bearer. It has 3 parts separated by dots, or 5 if it is an encrypted JWE.
Read the parts
The header and the payload appear as formatted JSON, and each claim is listed in a table. The times exp, nbf and iat are shown in UTC.
Check the time
The page compares exp and nbf with the clock of your device and says whether the token has expired. It does not say whether the token is genuine.
How a JWT is built
A JWT (RFC 7519) is written as header.payload.signature. The header and the payload are JSON objects, each encoded as Base64url without padding (RFC 4648, section 5), and the signature is raw bytes in the same encoding. Decoding only changes the encoding, so anyone who holds a token can read its payload: do not put secrets in it. The header names the signing algorithm in alg, such as HS256 (HMAC with SHA-256, a 32-byte signature) or RS256 (RSA with SHA-256, 256 bytes for a 2048-bit key).
This page decodes a token and does nothing more. It does not check the signature, because that needs the key, and it cannot tell you whether a token is genuine, revoked or accepted by a server. It compares the exp, nbf and iat claims, which count seconds since 1970-01-01 UTC, with the clock of your device and prints them as UTC date-times. A token with 5 parts is a JWE: its content is encrypted, so only its header can be shown.
JWT questions
How do I decode a JWT?
Paste the token into the box. The page splits it at the dots, converts the first two parts from Base64url and shows them as JSON. A leading Bearer is ignored. For the sample token the header is {"alg":"HS256","typ":"JWT"}.
Does this page verify the signature?
No. Verifying needs the secret or the public key, and this page never asks for one. A token that decodes here can still be forged, altered or revoked. Verify the signature in your own server code with a maintained JWT library.
What do exp, iat and nbf mean?
They are times in seconds since 1970-01-01 UTC (RFC 7519). exp is when the token expires, nbf is the time before which it must not be accepted, and iat is when it was issued. In the sample token, iat 1700000000 is 2023-11-14 22:13:20 UTC and exp 1700003600 is one hour later.
Is it safe to paste a real token here?
The token stays in your browser tab and is not sent anywhere. Still, a live token is a credential: anyone who holds it can use it until it expires. Paste tokens that you own, and prefer expired or test tokens when you can.
Why does my token have 5 parts?
A token with 5 parts is a JWE, an encrypted JSON Web Token (RFC 7516). Its payload is encrypted for the recipient, so this page shows only the header and the sizes of the parts. The content cannot be read here.
What does "not Base64url" or "not JSON" mean?
Each of the first two parts must be Base64url text that decodes to a JSON object. The page names the part that fails and why: a character outside the alphabet, bytes that are not UTF-8, or JSON with an error at a given line and column. A token cut short or with extra characters is the usual cause.