JWT Decoder
Read the header and the claims inside a JSON Web Token, including when it expires.
JWT Decoder
Header
{ "alg": "HS256", "typ": "JWT" }
- Payload
{ "sub": "demo", "name": "Daily Tools", "iat": 1700000000 } - Algorithm named in the headerHS256
- Issued atTue, 14 Nov 2023, 22:13 UTC
- Expires atNot stated
- ExpiryNo expiry time in the token
- Is the format validYes
Works out in your browser. Nothing you type is sent anywhere.
In short: JWT Decoder
The token above is Yes as a well-formed token, signed with the HS256 algorithm and typed as JWT, and it was issued at Tue, 14 Nov 2023, 22:13 UTC. Its expiry status is No expiry time in the token, and a signature is Yes. The signature itself is never checked here, because that would need your secret.
What is JWT?
A JSON Web Token is three Base64url-encoded parts separated by dots: a header, a set of claims, and a signature over both.
How is JWT calculated?
The header and the payload are JSON documents encoded with the URL-safe Base64 alphabet, which is why they can be read by anyone who has the token. The signature is computed over both with a secret or a private key, and is what makes the token trustworthy.
- headerwhich algorithm signed the token
- payloadthe claims, such as the subject and the expiry
- signatureproof that the first two parts were not altered
A worked example
| Paste the token | eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJkZW1vIiwibmFtZSI6IkRhaWx5IFRvb2xzIiwiaWF0IjoxNzAwMDAwMDAwfQ.signature-is-not-checked-here |
|---|---|
| Result | |
| Header | { "alg": "HS256", "typ": "JWT" } |
| Payload | { "sub": "demo", "name": "Daily Tools", "iat": 1700000000 } |
| Algorithm named in the header | HS256 |
| Issued at | Tue, 14 Nov 2023, 22:13 UTC |
| Expires at | Not stated |
| Expiry | No expiry time in the token |
| Is the format valid | Yes |
Every figure in this table is produced by the same calculation the tool above runs.
How to use this JWT decoder
- Paste the token.
- Read the header to see how it was signed.
- Read the claims, and check the expiry.
- Remember that anyone holding this token can read it too.
Questions people ask
Why is the signature not verified?
Because verifying it needs the secret or the public key, and sending a secret to a web page is exactly the mistake this site will not make. Decoding needs no key at all, which is why only that is offered. Verify on your own server, where the key lives.
Is a JWT encrypted?
No. The header and the payload are merely encoded, so anyone holding the token can read every claim in it, as this page demonstrates. Never put anything secret in a token. The signature prevents tampering, not reading.
What do iat and exp mean?
They are the issued-at and expiry times, both in seconds since the start of 1970, which this page converts to readable dates. A token past its expiry should be rejected by the server. The timestamp tool converts such figures on their own.
Is the token sent anywhere?
No. It is decoded inside this page and nothing is stored or sent, which matters a great deal for a token that is a live credential. This tool also refuses to put it into a shareable link.
Accuracy and sources
Checked by the Daytoolz team on 16 October 2026. How we check our tools.