Hanpy's Blog

Type at least two characters.

JWT decoder

Paste a token to read its header and payload and see when it expires.

🔒 Processed in your browser only — the token is never sent to a server or stored, and no share link is created.

Header

{
  "alg": "HS256",
  "typ": "JWT"
}

Payload

{
  "sub": "1234567890",
  "name": "Hanpy",
  "role": "admin",
  "iat": 1767225600,
  "exp": 1767229200
}

Time claims

exp · expires1767229200
UTC 2026-01-01T01:00:00ZLocal …
iat · issued at1767225600
UTC 2026-01-01T00:00:00ZLocal …

Signature

The signature is not verified (that needs the key).

cQ01CqB9SIuohv4Tvp5F0l2HjmR5lK6K0NktKizH898
Advertisement

How to use

  1. Paste a JWT into the box. A leading "Bearer " and line breaks are removed automatically.
  2. The header (alg, typ) and the payload claims appear as formatted JSON.
  3. The exp, iat and nbf claims are shown as UTC and local dates, with a check against the current time.
  4. Copy the parts you need. Press Clear when you are done with a real token.

FAQ

Is my token sent to a server?

No. Decoding happens only in your browser, and the token is never uploaded or stored. To keep tokens out of URLs, this tool does not create share links.

Does it verify the signature?

No. This tool only decodes the token. Verifying a signature needs the secret or public key and should be done by the server that accepts the token. "Valid" here only means the exp and nbf times allow it right now.

Is the JWT payload encrypted?

In a regular JWT (JWS) the header and payload are only base64url-encoded, so anyone can read them. Do not put secrets such as passwords in a payload. Encrypted tokens (JWE, with five dot-separated parts) cannot be read without the key and are not supported.

What do the exp, iat and nbf numbers mean?

They are time claims defined in RFC 7519, counted in seconds since 1970-01-01 00:00:00 UTC (Unix time). exp is the expiry time, iat is when the token was issued, and nbf means the token must not be accepted before that time.

Advertisement
See all tools →