Decode a JWT Token
A JSON Web Token is readable by anyone who sees it — only its signature is protected. Paste one and inspect the claims, issue time and expiry instantly.
- Copy the token from the Authorization: Bearer header or your app storage.
- Paste it into the JWT decoder.
- Read the decoded header and payload JSON, and check exp against the current time.
Uitvoeren
Voorbeelden
Invoer
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWUsImlhdCI6MTUxNjIzOTAyMn0.KMUFsIDTnFmyG3nMiGM6H9FNFUROf3wh7SmqJp-QV30
Uitvoer
<table class="tb-table"><tr><th colspan="2">Header</th></tr><tr><td>alg</td><td><code>"HS256"</code></td></tr><tr><td>typ</td><td><code>"JWT"</code></td></tr></table><table class="tb-table"><tr><th colspan="2">Payload</th></tr><tr><td title="Subject">sub <small>(Subject)</small></td><td><code>1234567890</code></td></tr><tr><td title="">name</td><td><code>John Doe</code></td></tr><tr><td title="">admin</td><td><code>true</code></td></tr><tr><td title="Issued at">iat <small>(Issued at)</small></td><td><code>1516239022 → 2018-01-18T01:30:22.000Z (EXPIRED/past)</code></td></tr></table><p class="tb-note">Algorithm: <b>HS256</b> · Signature present: yes (not verified — verification needs the secret/public key) · no exp claim</p>
The output above was produced by actually running this tool.
FAQ
Is my data uploaded for "Decode a JWT Token"?
No. The tool runs entirely in your browser — nothing is sent to any server.
Is it free?
Yes — unlimited, no sign-up, no installation.
Which tool does this use?
The JWT Decoder on 26173, linked at the bottom of this page.