JWT Decoder

Decode a JSON Web Token to read its header and payload claims, with issue and expiry times in plain dates.

Payload (claims) 
{
  "sub": "1234567890",
  "name": "Jane Developer",
  "role": "admin",
  "iat": 1767225600,
  "exp": 1798761600
}

Decoded only — the signature has not been verified, so do not trust these claims until your server checks it.

Algorithm
HS256
Issued at (iat)
2026-01-01 00:00:00 UTC
Expires (exp)
2027-01-01 00:00:00 UTC
Not before (nbf)
—
Expiry status
Valid — expires in 49 days
Signature
Present but NOT verified
Header 
{
  "alg": "HS256",
  "typ": "JWT"
}
Token lifetime (days since issued)
Valid0365Now

Runs entirely in your browser. Nothing you enter is uploaded.

How it works

A JSON Web Token is three Base64URL-encoded pieces joined by dots: a header saying how the token was signed, a payload of claims about the user or session, and a signature. Decoding the first two needs no key at all, which is why you should never put secrets like passwords in a JWT payload.

This tool decodes the header and payload and converts the standard time claims — iat (issued at), exp (expiry) and nbf (not before) — from Unix seconds into readable UTC dates, and tells you whether the token has expired according to your computer's clock.

It does not verify the signature. Anyone can create a token with any claims; only a check against the signing secret or public key proves it was issued by who you think. Treat what you see here as unverified information for debugging.

Decoding happens entirely in your browser. The token is never sent to a server, so it is safe to paste production tokens — though it is still good practice to revoke tokens you have exposed elsewhere.

Frequently asked questions

Why is the signature not verified?

Verification needs the secret (for HS256) or the issuer's public key (for RS256/ES256), which this page does not ask for. Verify signatures in your backend with a maintained JWT library.

What do sub, aud and iss mean?

sub is the subject — usually the user ID. iss is the issuer that created the token, and aud is the audience the token is meant for. Your API should reject tokens with an unexpected issuer or audience.

Can I edit a JWT here?

You could change the payload, but the signature would no longer match and any correctly configured server would reject it. That is the whole point of signing.

esc