JWT decoder
Inspect a JSON Web Token’s header, payload and expiry. Nothing is sent anywhere.
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkFkYSBMb3ZlbGFjZSIsImFkbWluIjp0cnVlLCJpYXQiOjE3NTM3MTIwMDAsImV4cCI6MTc4NTI0ODAwMH0.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
Timestamps
| Claim | Meaning | Value | When |
|---|---|---|---|
| exp | Expires at | 7/28/2026, 2:13:20 PM | 4 hours ago |
| iat | Issued at | 7/28/2025, 2:13:20 PM | 12 months ago |
Header
{
"alg": "HS256",
"typ": "JWT"
}Payload
{
"sub": "1234567890",
"name": "Ada Lovelace",
"admin": true,
"iat": 1753712000,
"exp": 1785248000
}Signature
Verifying this requires the signing key, which is not something to paste into a web page. Verify server-side, with the algorithm pinned.
SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
How it works
A JSON Web Token is three Base64URL segments joined by dots: a header saying how it was signed, a payload of claims, and a signature over the first two.
signature = HMACSHA256(base64url(header) + "." + base64url(payload), secret) The payload is not secret
Base64 is encoding, not encryption. Anyone with the token can read every claim in it — as this page just demonstrated. Never put anything confidential in a JWT payload. The signature guarantees the claims have not been altered; it does not hide them.
The alg: none attack
The specification permits an “unsecured” token with no signature. Several early libraries accepted such a token as valid, letting an attacker strip the signature and forge any claims they liked. Always pin the expected algorithm server-side rather than trusting the header.
Registered claims
- iss, sub, aud
- Who issued it, who it is about, who it is for.
- exp, nbf, iat
- Expiry, not-before and issued-at, all as Unix seconds.
- jti
- A unique ID, used for revocation lists and replay prevention.
Expiry does not equal revocation
A signed JWT stays valid until exp passes, whatever happens on the server. If you
need to revoke access immediately, you need short expiry times plus a refresh-token flow, or a
server-side denylist keyed on jti.