How to use the JWT Parser & Decoder
Step 1: Paste the full token into the box. A leading Bearer prefix is fine. Or press Load example to try a sample.
Step 2: Read the status message. It tells you whether the token has expired, is not valid yet, or has no expiry, based on your device clock.
Step 3: Check the Header for the algorithm and the Payload for the claims. Both are shown as formatted JSON.
Step 4: Read Claims explained for the issued, not-before and expiry times in plain words, and for the meaning of standard claims such as iss, sub and aud.
Step 5: Heed any warnings, for example an unsigned token, then press Copy to save the header or payload.
Features and benefits
Readable times
iat, nbf and exp are converted from seconds to dates, with wording such as in 2 hours or 3 days ago.
Clear status
See at a glance whether the token has expired or is not yet valid, with a reminder that the signature was not checked.
Security warnings
Tokens that use the none algorithm, have an empty signature or never expire are flagged.
Standard claims explained
iss, sub, aud, jti and similar claims are labelled so you do not have to remember them.
Private by design
The token is decoded locally and is never sent anywhere.
What is inside a JWT
A JSON Web Token has three parts joined by dots. The first, the header, names the signing algorithm. The second, the payload, holds the claims: statements such as who issued the token, who it is for and when it expires. The third is the signature. The header and payload are only Base64URL-encoded JSON, so anyone who holds the token can read them. They are not encrypted.
Because of that, never put secrets in a token payload. The signature protects the token from being changed, not from being read.
Decoding versus verifying
Decoding turns the first two parts back into readable JSON. Verifying checks the signature with the right key and also checks the claims, such as the expiry, the issuer and the audience. This page only decodes. A token that decodes cleanly may still be forged, altered or expired, so the check your server performs when it receives a token is what actually matters.
Reading the time claims
JWT times are stored as the number of seconds since 1 January 1970 UTC. This tool converts them to dates and compares them with the clock on your device. If your device clock is wrong, the expired or not-yet-valid message may be wrong too. Servers normally allow a small clock tolerance, so a token a few seconds past its expiry may still be accepted by one system and rejected by another.
Example use cases
Debugging login problems
Check whether a token has expired or carries the scopes and roles you expect.
Learning how tokens work
See that a JWT is just three Base64URL parts: a header, a payload and a signature.
Reviewing an integration
Confirm the issuer and audience claims match what your service expects.
Checking token lifetimes
Compare issued-at and expiry times to see how long a token is meant to live.
Frequently asked questions
Does this tool verify the signature?
No. Verifying needs the secret or public key. This tool only decodes the readable parts and checks the time claims against your device clock.
Is it safe to paste my token here?
The token is processed in your browser and is not uploaded. Even so, treat live tokens like passwords and prefer test tokens when you can.
Why does it say my token has no expiry?
The payload has no exp claim, so the token never expires by itself. That is a security risk for tokens that grant access.
Can it decode an encrypted token?
No. Tokens with five parts are encrypted (JWE) and cannot be read without the decryption key. The tool tells you when it sees one.
What is the none algorithm?
It means the token is unsigned. Anyone could have created it, so it must never be trusted for authentication.
Related tools
Base64 Encoder & Decoder
Encode text to Base64 or decode Base64 back to text, with URL-safe and Unicode support.
Developer Tools
JSON Formatter & Validator
Format, validate and minify JSON, with exact error locations. Runs in your browser.
Developer Tools
URL Encoder & Decoder
Percent-encode or decode text and URLs, and see a URL split into parts and query parameters.
Developer Tools
Last updated 11 November 2026.