JWT Decoder
Paste a JSON Web Token to decode its header and payload. Shows expiry and issued times in plain dates and flags expired or unsigned tokens.
JWTs look like opaque strings, but the header and payload are just base64url-encoded JSON anyone can read. This decoder splits the three parts, pretty-prints both JSON objects, converts exp/iat/nbf claims to human dates with relative countdowns, and tells you whether a signature is present. Everything runs locally — the token never leaves your browser.
How to use this calculator
- Paste the full JWT (header.payload.signature) into the box, or click Load sample.
- Read the decoded header and payload JSON instantly.
- Check the time claims — expiry is converted to a date with a humanized countdown and flagged if expired.
- Note the signature status: present-but-unverified, or missing entirely.
Worked example
The built-in sample token decodes to header {"alg":"HS256","typ":"JWT"} and a payload with sub "1234567890", name "John Doe", and iat 1516239022 — verified output: Thu, 18 Jan 2018 01:30:22 GMT. It carries no exp claim, so it never expires.
Frequently Asked Questions
What is a JWT?
A JSON Web Token is a compact signed token with three dot-separated parts: header, payload, and signature. Servers issue them at login and clients send them back with each request to prove identity. The header and payload are only base64url-encoded, not encrypted — anyone holding the token can read them, which is exactly what this decoder does.
Is it safe to paste my token here?
Yes. Decoding happens entirely in your browser with local JavaScript; the token is never sent to any server, and this page states that in the UI. That said, treat real production tokens like passwords — don't paste them into websites you don't trust, and prefer decoding in tools whose code you can inspect.
Why does it say the signature is not verified?
Verifying a signature requires the secret key (HMAC) or public key (RSA/ECDSA) the issuer used — which this page deliberately never asks for. Decoding shows you the claims inside the token; verification proves nobody tampered with it. To verify, use your backend or a library like jose in Node.
What do exp, iat, and nbf mean?
These are the registered time claims, all as Unix timestamps in seconds. exp is the expiry time after which the token must be rejected, iat is when it was issued, and nbf ('not before') is the earliest time it becomes valid. The decoder converts each to a readable UTC date and tells you in plain words whether the token is expired.
What does alg: none mean?
It means the token is unsigned — anyone can forge one with any claims they like. Historic attacks tricked servers into accepting 'none'-algorithm tokens. The decoder warns you explicitly: never trust an unsigned token for anything important.