Skip to content
HexSlate

JWT Decoder

Paste a token to decode it.

This tool decodes, it does not verify Verifying a signature needs the signing secret or public key, which this tool does not ask for. Treat every claim below as unverified until your backend's JWT library checks the signature.

Paste a token to decode it

The header, payload and expiry status appear as you type.

Base64url, not base64

A JWT's three segments (RFC 7519) use - and _ in place of + and /, with no = padding (RFC 4648 §5). They decode to bytes, and those bytes are UTF-8. A naive decode reading one byte per character turns an accented name, a non-Latin script or an emoji in a custom claim into mojibake. This one decodes through a UTF-8 byte decoder.

Common problems

  • Pasted the whole Authorization header.Bearer eyJhbGci... is a header value, not a token. The prefix rides along into the first segment, so it is reported as a header that is not valid base64url. Strip Bearer and the rest decodes.
  • Plain base64 instead of base64url. A re-encoded token can carry +, / or trailing =. Not valid in a JWT segment, and reported rather than repaired.
  • exp, iat or nbf shown as text, not a date. RFC 7519 §2 defines these as NumericDate: epoch seconds as a JSON number. An issuer encoding one as an ISO string is off spec.
  • Expired sooner than expected. Checked against your device clock with no grace period. Real verifiers usually allow a minute or two of skew, so this is the strict answer, not the lenient one your API gives.

Frequently asked questions

Why doesn't this tool verify the signature?

It needs the issuer's secret (HMAC, like HS256) or public key (RSA or ECDSA, like RS256). A page in your browser has no safe place to hold either: a symmetric secret typed into a web form is a secret that page can leak. Verify server-side, where the key lives.

What is the difference between a JWT, a JWS and a JWE?

JWT is the general format. A signed JWT, the only kind this reads, is a JWS Compact Serialization: three segments. An encrypted token is a JWE (RFC 7516), five segments whose payload is ciphertext, and nothing decodes without the key.

Is it safe to paste a token here?

The token never leaves your browser: it is decoded in this tab and is not put in the URL or in storage. Treat any token you have pasted anywhere else as exposed, though, and remember a JWT is a bearer credential, so anyone holding it can use it until it expires.

What does exp actually mean?

Seconds since the Unix epoch, not milliseconds, which is the most common bug when writing tokens by hand: a millisecond value puts the expiry roughly fifty thousand years out. The spec also allows a small clock skew allowance, so a token can be rejected as expired by a server whose clock runs slightly ahead of yours.