Toolstia / JWT decoder
JWT decoder
Paste a JSON Web Token (JWT) to see its header and payload as readable JSON, with the issued, not-before and expiry dates turned into normal dates. It also tells you whether the token has expired.
The token is decoded in your browser and is not sent anywhere. Even so, avoid pasting live production tokens into any website.
How it works
- Paste the token. A leading "Bearer " is fine.
- Read the header and payload.
- Check the dates and the expired notice.
What a JWT is
A JWT has three parts separated by dots: a header, a payload and a signature. The header and payload are just JSON written in Base64URL, which is why anyone can decode them without a key.
Decoding is not verifying
This tool does not check the signature, because that needs the secret or public key. A token that decodes cleanly may still be forged, so your server must verify it before trusting any claim.
Common claims
sub is the subject, usually a user ID. iss is the issuer. aud is the audience. iat is when it was issued, nbf is the time before which it is not valid, and exp is when it expires. The dates are Unix times in seconds.
Handle tokens with care
A live token can act like a password. This page decodes it in your browser without sending it anywhere, but you should still avoid pasting production tokens into websites you do not control.
Questions
Is the token uploaded?
No. It is decoded by your browser.
Why does it say the token is invalid?
The text may be cut off, or it may not be a JWT. A JWT has three parts separated by two dots.
Can it tell me if the signature is valid?
No. Verifying needs the key, so do that on your server or with your auth library.
What time zone are the dates in?
UTC. The expiry check compares with the current time on your device.