Troubleshoot a 401 error
An API rejects your request: decode the Bearer token to see whether it has expired, whether the aud audience matches the API you call, or whether the iss issuer points to the right environment.
JWT Decoder
Paste a JSON Web Token: the header and payload are decoded to JSON as you type, with a summary of the algorithm, issuer, audience and the exp, iat and nbf dates in local time.
- Clipboard
Data not sent
Token details
- Algorithm
alg - Type
typ - Key ID
kid - Issuer
iss - Subject
sub - Audience
aud - Expires
exp - Issued
iat - Not before
nbf
Header
Payload
Decoding does not verify the signature: anyone can read a JWT. To check the signature, use the JWT verifier.
Was this tool useful?
How does this tool work?
The JWT decoder shows the header and payload of a JSON Web Token in plain JSON as soon as you paste it. It is built for developers, testers and support teams who need to understand what an access token or ID token contains: algorithm, issuer, audience and validity dates. It reads the token but does not verify its signature.
A signed JWT (RFC 7519, in the JWS compact format of RFC 7515) is made of three dot-separated segments: header, payload and signature. The first two are JSON encoded in Base64URL, a Base64 variant that replaces + and / with - and _ and drops the = padding. The decoder splits the token, converts each segment to UTF-8 text and parses it as JSON. For example, the segment eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9 is {"alg":"HS256","typ":"JWT"}.
The summary then extracts the useful fields: alg and typ from the header, iss (issuer), sub (subject) and aud (audience) from the payload. The exp, iat and nbf claims are NumericDate values, a number of seconds since January 1, 1970 UTC: 1767225600 is January 1, 2026 at 00:00 UTC. The tool converts them to local time and tells you whether the token is valid, expired or not yet valid. A warning appears when the header declares alg: none, meaning an unsigned token.
How to use this tool
Paste the JWT
Paste the full token with its three dot-separated parts. Decoding starts as you type, with no button to click.
Read the header and payload
Both segments are shown as formatted JSON: algorithm and type in the header, standard and custom claims in the payload.
Check the summary
Review the algorithm, iss, sub, aud and the exp, iat and nbf dates in local time with their status. To check the signature, move on to the JWT verifier.
Use cases
Read the roles in an ID token
After an OpenID Connect login (Auth0, Keycloak, Entra ID, Cognito), check custom claims such as roles, groups or scope to understand why a user cannot access a page.
Check token lifetimes
Compare iat and exp to confirm that your identity provider really issues access tokens valid for 5, 15 or 60 minutes, as your configuration intends.
Examples
Decode a demonstration JWT
Input
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5cResult
Header: {"alg":"HS256","typ":"JWT"}; Payload: {"sub":"1234567890","name":"John Doe","iat":1516239022}; the signature is not verified when decoding.Tips and best practices
- Remove the "Bearer" prefix copied from an Authorization header: only the eyJ… token should be pasted.
- A token starting with eyJ that has five segments is an encrypted JWE (RFC 7516): its content cannot be read without the decryption key.
- A "valid" status only concerns the dates: a readable, unexpired token may still be forged as long as its signature has not been verified.
Sources and references
- M. Jones, J. Bradley, N. Sakimura, RFC 7519 — JSON Web Token (JWT) (opens in a new tab), RFC Editor, 2015Page in English
Frequently asked questions
Can you decode a JWT without the secret key?
Yes. The header and payload are only Base64URL-encoded, not encrypted, so anyone holding the token can read them. The key is only needed to verify the signature, which is the job of the JWT verifier, not this decoder.
Is the content of a JWT encrypted?
No, a signed JWT (JWS) is readable by anyone; the signature only proves it has not been modified. Never put passwords or confidential data in the payload. If the content must stay secret, use a JWE (RFC 7516).
What do exp, iat and nbf mean?
exp is the expiration time, iat the issued-at time and nbf the time before which the token must not be accepted. They are Unix seconds (NumericDate, RFC 7519), not milliseconds. The tool shows them in local time with a valid, expired or not-yet-valid status.
Why does the alg: none warning matter?
alg: none means the token is not signed at all. A server that accepts it lets anyone mint their own tokens, a well-known flaw listed in RFC 8725. A production application must always enforce an allow-list of algorithms.
Why won’t my JWT decode?
The token is often truncated during copy and paste, still contains the Bearer prefix or quotes, or does not have three segments. A segment that is not valid Base64URL, or whose content is not JSON, also triggers an error.
Is it risky to paste a real token into an online decoder?
A valid access token is a credential: whoever gets it can use it until it expires. Here, decoding happens in your browser and the token is not sent to any server. Still, prefer test or already expired tokens whenever you can.
Recommended workflow
Continue your processing
Discover tools that naturally fit before, after, or alongside this one.
Works well with
Encode text as Base64 or decode a Base64 string back to its original content.
Security & privacyFeaturedUse this tool
Format, minify, and validate JSON to make it easier to read or more compact.
Security & privacyFeaturedUse this tool
Compute MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hashes of a text or file in one go.
Security & privacyFeaturedUse this tool
Next step
Verify a JWT signature with an HMAC secret or a JWK, JWKS or PEM public key, then check exp, nbf, iss and aud.
Security & privacyUse this tool
Read next
GuideBest practicesBeginner
JWT: understand structure, signature, expiration and common mistakes
Learn what a JWT contains, why decoding is not verification, how claims such as exp, nbf, iss and aud work, and common security mistakes.
29 August 20262 min
GuideBest practicesIntermediate
OAuth 2.0, PKCE, JWT, JWK and JWKS: understand their roles
Understand how OAuth 2.0, PKCE, JWT, JWK and JWKS fit together: authorization, tokens, public keys and verification.
23 September 20262 min
TutorialBest practicesBeginner
How to securely redact a PDF before sharing it
Learn why covering text is not enough, how secure PDF redaction removes sensitive information and why sanitization matters before sharing.
10 September 20262 min
GuideBest practicesBeginner
Content Security Policy (CSP): reduce XSS risks and unwanted loads
Learn how to introduce a CSP progressively, understand its main directives, Report-Only mode, nonces and common mistakes.
29 August 20261 min