JWT Decoder: Reading Claims, Expiry and Why “Valid” Isn’t Checked

What is it?

The JWT Decoder splits a JSON Web Token into its header and payload, and shows times like exp and iat as readable dates.

Who is it for?

Developers debugging sign-in and API errors, testers checking token expiry and roles, and security learners exploring how JWTs work.

How to use it

1. Paste the token. A JWT has three parts separated by dots: header.payload.signature. A leading Bearer is fine.
2. Read the header (algorithm, key id) and the payload (user, roles, expiry).

Useful claims

• exp: when the token expires. Expired tokens are the most common cause of sudden 401 errors.
• iat: when it was issued. nbf: not valid before.
• iss, aud: who issued it and who it is for. A mismatch here causes “invalid audience” errors.

Decoding is not verifying

Anyone can read a JWT’s payload: it is only Base64URL-encoded, not encrypted. This tool does not check the signature, so it can’t tell you if a token is genuine. Your server must verify the signature with its secret or public key. Never put passwords or secrets inside a JWT payload.

Safety

A live token works like a temporary password. The decoder runs in your browser and doesn’t send it anywhere, but don’t paste production tokens into tools you don’t trust, and never share them in chats or tickets.

Example

A payload with "exp": 1767225600 expires on 1 January 2026, 00:00 UTC (5:30 am IST).

Open the tool: JWT Decoder

Still stuck?

Contact support. Tell us which tool or page you were using, what you tapped, what you saw, and your phone or computer and browser (for example: Android phone, Chrome). We reply by email.