Paste a JSON Web Token to read its header, payload claims and signature bytes, and see at a glance whether it has expired. Decoding runs locally in your browser.
Paste a JWT token above to decode it
A JSON Web Token (JWT, defined in RFC 7519) is the long xxxxx.yyyyy.zzzzz string that many login systems and APIs pass around in an Authorization: Bearer header or a cookie. The first two parts are Base64URL-encoded JSON, so anyone holding the token can read them. This decoder turns a pasted token back into readable JSON: the header (signing algorithm and token type), the payload with all of its claims, and the raw signature bytes. It is handy when a request is rejected and you want to check which user, audience or scope the token carries, or whether it simply expired.
Bearer prefix is not, so remove that first.alg), Type (typ), an expiry badge (Not Expired with the time remaining, Token Expired with how long ago, or No Expiration) and the Issued time from iat.iss, sub, aud, exp, nbf, iat and jti, plus common ones like email, role, scope, azp and nonce, get a short description, and the three time claims are converted to a readable date.The token is split at the dots and must have exactly three parts. For the header and payload, the page converts Base64URL to standard Base64 (- becomes +, _ becomes /, missing = padding is restored), decodes the bytes as UTF-8 and parses them with JSON.parse. If either step fails you see a decode error instead of partial output. The signature is decoded to bytes and displayed in hex; it is never checked. All of this is plain JavaScript in your browser: the token is not uploaded, logged or stored.
Times are compared with your device clock. exp, iat and nbf are seconds since 1 January 1970 UTC and are displayed in your local time zone in YYYY-MM-DD HH:MM:SS form. The expiry badge only looks at exp; a token whose nbf (not before) is still in the future is shown in the table but not flagged.
“Not Expired” does not mean the token is valid. Without verifying the signature with the issuer's secret or public key, anyone could have edited the payload. Always verify tokens on the server with a maintained JWT library before trusting their claims.
No. It shows the signature bytes but does not check them. Verification needs the HMAC secret (HS256 and similar) or the issuer's public key (RS256, ES256 and similar) and belongs in your backend or a trusted local tool.
Decoding happens only in your browser and nothing is sent to ToolHub. Still, a live access token works like a password until it expires, so avoid pasting production tokens on shared or untrusted computers, and never share screenshots of them.
The input does not have exactly three dot-separated parts. Common causes are a truncated copy, an extra dot or other text pasted along with the token, or an encrypted JWE token, which has five parts and cannot be read without the decryption key.
Your computer clock may differ from the server's, and many servers allow a few minutes of leeway. The badge uses your local clock with no leeway, so tokens right at the boundary can disagree.
No. A signed JWT (JWS) is only encoded, which is why this page can read it. Do not put passwords, card numbers or other secrets in a JWT payload.