JWT Decoder – Read JSON Web Token Header and Payload

How to use the JWT decoder

1. Paste your token — three groups of characters separated by dots.
2. Read the decoded header and payload in the output.
3. Check the status line for when the token was issued and when it expires.

Press Try an example to see a sample token.

The three parts of a JWT

Header — the token type and signing algorithm, for example:

{"alg": "HS256", "typ": "JWT"}

Payload — the claims, for example:

{"sub": "1234567890", "name": "John Doe", "iat": 1516239022}

Signature — created from the header and payload with a secret (HMAC) or a private key (RSA or ECDSA). It proves the token wasn’t changed, but only a server holding the key can check it.

Each part is Base64URL-encoded and the parts are joined with dots:

Worked example

In the sample token, iat is 1516239022, which is 18 January 2018 at 01:30:22 UTC. There is no exp claim, so the token never expires on its own — something a real application should avoid.

Debugging authentication problems

• “Token expired” — compare exp with the current time; remember it is in UTC seconds.
• “Invalid audience” or “invalid issuer” — check aud and iss against your server settings.
• Clock skew — if iat or nbf is slightly in the future, the server’s clock may be out of sync.
• Wrong algorithm — the header’s alg must match what your server expects. Servers should reject none.
• Missing claims — check the payload contains the roles or scopes your API needs.

Where JWTs are used

JWTs are common in single-page apps and mobile apps that talk to APIs, in single sign-on with OpenID Connect (where the ID token is a JWT), and in service-to-service authentication. A typical flow is: you log in, the server issues a short-lived access token and a refresh token, and the app sends the access token in the Authorization header with each request. When it expires, the app quietly uses the refresh token to get a new one. Decoding the token is often the fastest way to see why a request is being rejected.

Security tips

• Keep tokens short-lived and use refresh tokens for long sessions.
• Never put passwords or sensitive personal data in the payload.
• Always verify the signature on the server before trusting any claim.
• Store tokens carefully in the browser to reduce the risk of theft.

To decode other Base64 data, use the Base64 decoder; to convert timestamps, the Unix timestamp converter; and to tidy JSON, the JSON formatter.