Paste a JSON Web Token to read the middle segment: the payload. A signed JWT is three Base64URL parts joined by dots; decoding needs no key because the payload is encoded, not encrypted. Claims such as exp, iat, sub and aud appear as formatted JSON. The signature is shown and never checked. Nothing leaves this tab.
{
"alg": "HS256",
"typ": "JWT"
}{
"sub": "ada",
"name": "Ada Lovelace",
"iat": 1700000000,
"exp": 1893456000
}signature-not-verified
Runs in this tab · nothing is uploaded · Verify in 10 seconds →
A JWT (RFC 7519) is three Base64URL segments joined by two dots; the middle segment is the payload, and Base64URL is an encoding, not encryption: no key is needed to read it. Paste a token below and the payload's claims (exp, iat, sub, iss and any custom ones) appear as formatted JSON. The signature is shown but never checked: decoding is not verification.
The claims that matter are timestamps in Unix seconds, always 10 digits for current dates. An exp of 1767225600 means the token dies at 2026-01-01T00:00:00Z; compare it with now and you have answered the most common JWT question (“why 401?”) with one decode and one conversion. A payload with no exp claim at all never expires unless the server imposes its own lifetime, itself a finding worth reporting.
“A JWT has three segments separated by dots.” means the paste is incomplete or not a JWT, check for truncation, and count the dots: four dots is an encrypted JWE, whose payload no decoder can show without the key. “Could not decode this token. Check the Base64URL segments.” means a segment is corrupted, usually characters lost or added in transit through a chat app or shell.
Inspect the payload when debugging authentication: expiry, subject, audience, scopes, and whether the identity provider actually added the custom claim your code reads.
This page is a focused view of theJWT Decoder, which has the full set of options.
The token never leaves this tab, decoding is pure client-side Base64URL and JSON parsing. Still, treat live production tokens as secrets: prefer expired or test tokens when you can, and never paste tokens into tools that send them to a server.
A standard signed JWT (RFC 7519) is encoded, not encrypted. Base64URL is an encoding anyone can reverse; the signature only proves who issued the token and that it was not modified. Confidential claims require an encrypted JWE instead.
exp is a Unix timestamp in seconds. Convert it with the Unix Timestamp Converter. If it is in the past, the token is expired and the API is right to reject it.