WebTools

Decode a JWT

Header, payload and expiry. The signature is not verified.

Open a JSON Web Token and show what is inside: the header’s algorithm, every field of the payload, and the issued, valid-from and expiry dates converted to local time.

A JWT is not encrypted, only Base64-encoded: anyone holding it can read the contents. Which is why you should never put anything in one you would not want seen.

How to use it

  1. Paste the token, with or without the Bearer prefix.
  2. Read the header and the payload.
  3. Check the expiry line.

Frequently asked questions

Is the signature verified?
No. Verifying it would need the issuer’s secret or public key, and this tool has neither. It is for seeing the contents, not for deciding whether the token can be trusted.
Does the token reach a server?
No. The decoding is plain Base64 done in the tab, which matters rather a lot when what you are pasting is a live session token.
What does expired mean?
That the exp field is earlier than now. Many servers allow a few seconds of clock skew, but an expired token is normally rejected.

Related tools