JWT Decoder & Expiry Checker

What is a JWT?

A JSON Web Token (JWT) is a compact string used to pass signed claims between systems, most often for login sessions and API access. It has three parts separated by dots: a header, a payload and a signature. The header and payload are Base64URL-encoded JSON, so anyone who has the token can read them. Only the signature proves the token has not been changed.

How to use this decoder

1. Paste your token into the box. A leading "Bearer " is removed for you.
2. Read the header, the payload and the time claims. The status box tells you whether the token is expired or not yet valid.
3. Optionally enter the secret to verify HS256, HS384 or HS512 signatures. Tokens signed with RSA or ECDSA need a public key and are decoded but not verified here.

Example

The standard demo token with the secret your-256-bit-secret decodes to:

{
  "alg": "HS256",
  "typ": "JWT"
}
{
  "sub": "1234567890",
  "name": "John Doe",
  "iat": 1516239022
}

The iat value is a Unix timestamp. Use the Load example button to try it.

Common JWT claims

iss is the issuer, sub the subject (usually the user ID), aud the intended audience, exp the expiry time, nbf the time before which the token is not valid, iat the time it was issued, and jti a unique token ID. Time claims are Unix timestamps in seconds.

Frequently asked questions

Is it safe to paste my JWT here?

Decoding runs entirely in your browser and nothing is uploaded. Even so, treat tokens like passwords: avoid pasting live production tokens or secrets into any website, and prefer test tokens.

Does decoding verify the token?

No. Anyone can decode a JWT. Verification means checking the signature with the right key, which your server must always do before trusting the claims.

Why does my token show as expired?

The exp claim is a Unix timestamp in seconds. If the current time is past it, the token is expired. Check that your server clock is correct, since clock drift is a common cause.

What is alg none?

It means the token is unsigned. Servers should reject such tokens, as accepting them lets anyone forge claims.

What if my token has five parts?

That is an encrypted token (JWE). Its contents cannot be read without the decryption key.

Related tools

Base64 Encoder/Decoder · Base64 to JSON · Hash Generator · Timestamp Converter

Decoding a token does not prove it is genuine. Always verify signatures on your server, and avoid pasting production secrets into any website.