JWT Decoder

What is inside a JWT

A JSON web token is three Base64url strings joined by dots: a header saying how it was signed, a payload of claims, and a signature. The first two are only encoded, not encrypted — anyone holding the token can read them, which is exactly what this page does.

The usual claims

• iss who issued it · sub who it is about · aud who it is for
• iat when it was issued · exp when it expires · nbf not valid before
• jti a unique id for the token, used to revoke it
• Anything else the application put there — a role, a tenant, a user id

How to use the JWT decoder

1. Paste the token. A leading "Bearer " is ignored, so you can paste straight from a header.
2. Read the claims on the right, with the issued and expiry times shown as real dates.
3. Check the state line to see whether it has expired — the usual reason an API call comes back 401.

What this does not do

• It does not verify the signature. That needs the secret or public key, and a key should never be pasted into a web page.
• A decoded token proves nothing about whether it is genuine. Only the server with the key can say that.
• Nothing is uploaded — the decoding happens in your browser — but a token is a credential, so treat it carefully anyway.

Common problems it answers

• "401 after a while": look at exp — the token has almost certainly expired.
• "Works locally, fails in production": compare iss and aud between the two tokens.
• "Permission denied": check the role or scope claims are what the API expects.

Frequently asked questions

Is it safe to decode a JWT online?

This page decodes the token inside your browser and sends nothing anywhere, so it is as safe as opening the file locally. Even so, a live token is a credential — prefer a test token when you can.

Can you decode a JWT without the secret key?

Yes. The header and payload are only Base64url encoded, not encrypted. The secret is needed to verify the signature, not to read the contents.

Why does my token say it is expired?

The exp claim is a Unix timestamp. If it is in the past, every properly written server will reject the token and you need to log in again or refresh it.