Decode a JWT

A JWT is three Base64URL segments separated by dots: a header (algorithm and type), a payload (the claims), and a signature. The first two are only encoded, not encrypted, so anyone holding the token can read them. This tool decodes both, converts the time claims into ISO dates, and tells you whether the token is expired or not yet valid. A leading Bearer prefix is stripped automatically.

Input

Example

Input

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

Output

{
  "header": {
    "alg": "HS256",
    "typ": "JWT"
  },
  "payload": {
    "sub": "1234567890",
    "name": "John Doe",
    "iat": 1516239022
  },
  "expiry": {
    "issued_at": "2018-01-18T01:30:22.000Z"
  },
  "signature_verified": false,
  "note": "Signature is NOT verified. Decoding a JWT proves nothing about authenticity."
}

This is the well-known example token from the JWT specification material, safe to decode anywhere. The numeric iat claim becomes a readable date.

Input and output

Input is a complete JWT (header.payload.signature), with or without a Bearer prefix. Output is JSON: the decoded header, the decoded payload, an expiry block when the token carries exp, iat, or nbf, and an explicit signature_verified: false.

Verification is deliberately absent. Checking a signature requires the signing secret or public key, and that check belongs on a server. A tool that decodes in the browser and implies the token is therefore valid would be lying to you.

Privacy

This tool runs entirely in your browser. The input is never uploaded, logged, or stored; close the tab and it is gone. The one deliberate exception in the whole Toolbox is the explicit Save as new paste button on the output, which does exactly what it says and nothing before you press it.

The token never leaves the page. A JWT is frequently a live session credential; decoding it on someone else's server is equivalent to sending them your session. If you did paste a production token into an uploading tool in the past, treat that token as leaked and rotate it.

Common uses

Checking why an API rejects a token: expired, not yet valid, wrong audience
Confirming which claims your identity provider actually puts in the token
Reading the algorithm header when debugging a signature mismatch
Inspecting a token from a HAR file or log during an incident

Need to share the result?

Run the tool, then use Save as new paste on the output to get a link you can send. The paste is unlisted, expires in a week, and the recipient needs no account. Or start from a blank paste if you already have the text.

Related tools

More tool pages: Format and validate JSON, Decode Base64 to text, Generate UUIDs, Convert a Unix timestamp to a date, Convert CSV to JSON. Everything else lives in the full Toolbox, which also chains tools into workflows.