Header
{
"alg": "HS256",
"typ": "JWT"
}Inspect a JWT payload
A JWT (RFC 7519) is three Base64URL segments joined by two dots; the middle segment is the payload, and Base64URL is an encoding, not encryption — no key is needed to read it. Paste a token below and the payload's claims (exp, iat, sub, iss and any custom ones) appear as formatted JSON. The signature is shown but never checked: decoding is not verification.
The claims that matter are timestamps in Unix seconds — always 10 digits for current dates. An exp of 1767225600 means the token dies at 2026-01-01T00:00:00Z; compare it with now and you have answered the most common JWT question (“why 401?”) with one decode and one conversion. A payload with no exp claim at all never expires unless the server imposes its own lifetime — itself a finding worth reporting.
Payload
{
"sub": "ada",
"name": "Ada Lovelace",
"iat": 1700000000,
"exp": 1893456000
}Signature (not verified)
signature-not-verified
When it goes wrong
“A JWT has three segments separated by dots.” means the paste is incomplete or not a JWT — check for truncation, and count the dots: four dots is an encrypted JWE, whose payload no decoder can show without the key. “Could not decode this token. Check the Base64URL segments.” means a segment is corrupted — usually characters lost or added in transit through a chat app or shell.
When to use this
Inspect the payload when debugging authentication: expiry, subject, audience, scopes, and whether the identity provider actually added the custom claim your code reads.
This page is a focused view of theJWT Decoder, which has the full set of options.
Next steps
Frequently asked questions
Is it safe to paste a real token here?
The token never leaves this tab — decoding is pure client-side Base64URL and JSON parsing. Still, treat live production tokens as secrets: prefer expired or test tokens when you can, and never paste tokens into tools that send them to a server.
Why are JWT payloads readable without a key?
A standard signed JWT (RFC 7519) is encoded, not encrypted. Base64URL is an encoding anyone can reverse; the signature only proves who issued the token and that it was not modified. Confidential claims require an encrypted JWE instead.
How do I read the exp claim?
exp is a Unix timestamp in seconds. Convert it with the Unix Timestamp Converter — if it is in the past, the token is expired and the API is right to reject it.