JWT Decoder

Q: Why does it say the token is expired?

The exp claim is earlier than your device’s current time. If your clock is wrong, the verdict will be too.

Paste a JSON Web Token to read its header and claims. Timestamps are shown as dates and the token’s expiry is checked against your clock. Nothing is sent anywhere.

Encoded token

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJjdXN0XzQxMiIsIm5hbWUiOiJBZGEgTG92ZWxhY2UiLCJyb2xlIjoic3RhZmYiLCJpYXQiOjE3OTAwMDAwMDAsImV4cCI6MTc5MDAwMzYwMH0.mYd1Gd2ZHHZkK3gOmpWnI0Q5c1yIHm8Tq3f1vTZxY4s

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJjdXN0XzQxMiIsIm5hbWUiOiJBZGEgTG92ZWxhY2UiLCJyb2xlIjoic3RhZmYiLCJpYXQiOjE3OTAwMDAwMDAsImV4cCI6MTc5MDAwMzYwMH0.mYd1Gd2ZHHZkK3gOmpWnI0Q5c1yIHm8Tq3f1vTZxY4s

Header

{
  "alg": "HS256",
  "typ": "JWT"
}

Algorithm HS256

Payload

{
  "sub": "cust_412",
  "name": "Ada Lovelace",
  "role": "staff",
  "iat": 1790000000,
  "exp": 1790003600
}

Claims explained

`sub`	Subject	`cust_412`
`name`	Name	`Ada Lovelace`
`role`	Role	`staff`
`iat`	Issued at	2026-09-21 14:13:20 UTC ()
`exp`	Expires	2026-09-21 15:13:20 UTC ()

Anatomy of a JWT

A JWT (RFC 7519) is three Base64URL strings joined by dots: header (algorithm and type), payload (the claims) and signature. The first two are just encoded JSON — anyone holding the token can read them, which is exactly what this page does. Never put secrets in a JWT payload.

Decoding is not verifying

The signature proves the token was issued by someone holding the key. Checking it needs that secret (HS256) or public key (RS256/ES256), and should happen on your server with a maintained library. This decoder does not verify signatures, so it never asks for your key.

Standard claims

Claim	Meaning
`iss`	Issuer — who created the token
`sub`	Subject — usually the user ID
`aud`	Audience — who the token is for
`exp`	Expiry time (Unix seconds)
`nbf`	Not valid before
`iat`	Issued at
`jti`	Unique token ID

Questions

Is it safe to paste a production token here?

Decoding happens in your browser and nothing is transmitted or stored. Still, a live token is a credential — treat it like a password and prefer expired or test tokens.

Why does it say the token is expired?

The exp claim is earlier than your device’s current time. If your clock is wrong, the verdict will be too.

Can it decode JWE (encrypted) tokens?

No. A JWE has five parts and an encrypted payload that needs the key to read.