How to decode a JWT
- Paste the token (with or without the
Bearerprefix). - The header and payload appear as formatted JSON.
- Time claims like
expandiatare shown as readable dates, with a clear expired/valid indicator.
JWT structure
A JSON Web Token has three Base64URL-encoded parts separated by dots: the header (algorithm and token type), the payload (claims such as user ID, roles and expiry) and the signature. The header and payload are only encoded, not encrypted, so never put secrets in a JWT payload.
Debugging tips
- 401 errors right after login? Compare
expandnbfwith the current time. Clock skew between servers is a frequent cause. - Wrong permissions? Check the
scope,rolesoraudclaims. - "alg": "none" should never be accepted by your server.
Related: Base64 Decoder, Unix Timestamp Converter, JSON Formatter.
Standard JWT claims
iss(issuer): who created the token, such as your auth server URL.sub(subject): who the token is about, usually a user ID.aud(audience): which API or app the token is meant for.exp,nbf,iat: expiry, not-before and issued-at times in seconds since 1970.jti: a unique token ID, used to prevent replay.
Providers add their own claims too, for example scope, roles, email or tenant_id.
Signing algorithms
The alg field in the header tells you how the token is signed. HS256 uses a shared secret, so every service that verifies the token can also create one. RS256 and ES256 use a private key to sign and a public key to verify, which is safer when several services need to check tokens. Servers should only accept the algorithms they expect, and never none.
Access tokens vs. ID tokens
In OAuth 2.0 and OpenID Connect, an ID token tells the client who signed in and is meant to be read by the app. An access token is meant for the API; some providers make it a JWT you can decode here, while others issue opaque tokens that are not JWTs at all. If decoding fails with “three parts” errors, you may be holding an opaque token.
Keep tokens out of URLs and logs
A JWT works like a temporary password. Avoid putting tokens in query strings, screenshots or support tickets, and redact them in logs. If a token leaks, revoke the session or wait for it to expire.
Frequently asked questions
Is it safe to paste my JWT here?
Decoding happens only in your browser and the token is never sent anywhere. Still, treat production tokens like passwords and avoid sharing them.
Does this verify the signature?
No. It only decodes the header and payload. Signature verification requires the secret or public key and must be done by your server.
What do exp, iat and nbf mean?
They are standard time claims in seconds since 1970: exp is when the token expires, iat is when it was issued, and nbf is the time before which it must not be accepted.