Decode JSON Web Tokens and read the header, claims and expiry.
A “Bearer ” prefix is removed automatically.
Standard HS256 token
The canonical example token
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5cWith a Bearer prefix
Pasted straight from an Authorization header
Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJhZG1pbiIsImV4cCI6MTAwMDAwMDAwMH0.abcMalformed token
Only two segments — see the error
eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxIn0Standard HS256 token
The canonical example token
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5cWith a Bearer prefix
Pasted straight from an Authorization header
Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJhZG1pbiIsImV4cCI6MTAwMDAwMDAwMH0.abcMalformed token
Only two segments — see the error
eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxIn0A Bearer prefix is stripped automatically, so you can paste an Authorization header value directly.
The header shows the algorithm and token type. The payload lists every claim, with standard ones labelled in plain language.
Issued-at, not-before and expiry are converted to readable dates, and an expired token is flagged clearly.
Claims like exp and iat are raw epoch seconds. Seeing them as dates, with an expiry warning, is usually the whole reason you opened a decoder.
The tool decodes and says plainly that it does not verify, rather than implying a token is trustworthy because it displayed correctly.
A JWT is a live credential. Decoding locally means pasting one here does not hand it to anyone.
Paste a JWT and see what is inside it: the signing algorithm from the header, every claim in the payload, and the standard time claims converted from raw epoch numbers into dates you can read. Expiry is checked against the current time and flagged, which answers the question people are usually asking. Decoding only — the signature is never verified, because doing so would require you to paste a signing secret into a web page, and no tool should ask that of you.
Keep going
Related pages in Security & Privacy, plus what others are using right now.
More security & privacy that pair well with this one.
Decode Base64 back to readable text, with clear errors when it is not valid.
Encode text to Base64, including full Unicode and URL-safe output.
Convert Unix timestamps to dates and back, in seconds or milliseconds.
Generate MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hashes at once.
Create strong random passwords with full control over length and characters.
Test how strong a password really is, and see exactly what weakens it.
Format, validate and minify JSON, with errors that point to the exact line.
Work out any percentage — of a number, as a share, or as a change.
Count words, characters, sentences and paragraphs as you type.
Convert between length, weight, temperature, volume, speed, data and more.
Count characters with and without spaces, against the limits that matter.
Find the mean, median, mode and range of a list of numbers, with the working shown.
Sample and population standard deviation and variance, both shown, with the working.
Turn a logo into favicon.ico, the PNG sizes a site needs, and the HTML to declare them.
Stamp text like DRAFT or CONFIDENTIAL across a PDF, in your browser.
Turn JSON into readable YAML, with quoting and multiline strings handled properly.
Escape text for HTML, or turn entities back into readable characters.
Explain a cron expression in plain English and see exactly when it will next run.