JWT decoder
A JWT's header and payload, its expiry and a signature check with a secret or key.
The result will appear here
The result will appear here
The result will appear here
The result will appear here
Calculated in your browser — nothing is sent to the server
In a Linux terminal
TOKEN='eyJhbGciOi…'
cut -d. -f2 <<< "$TOKEN" | tr _- /+ | base64 -d | jq .
# payload
date -d @1893456000
# exp as a date
curl -H "Authorization: Bearer $TOKEN" example.com/me
# a request with the token
base64 -d complains about the missing = at the end, but the output is still right.
Keep in mindA JWT payload is not encrypted: anyone with the token can read it, so keep passwords and secrets out.
What is inside a JWT
Three parts separated by dots: header, payload and signature. The first two are base64url JSON
that anyone holding the token can read, so passwords and personal data never go there. exp,
iat and nbf are in Unix seconds.
FAQ
Why is the token “expired” when the server accepts it?
The time is compared with your computer's clock, and servers usually allow a few minutes of skew.
An exp with 13 digits is in milliseconds, which is a bug in the issuer.
What does “signature does not match” mean?
The token was signed with another key or changed. For HS256, check the secret: a stray space, a line break, or a secret stored in Base64 — then turn on “Secret in Base64”.
What is the difference between HS256 and RS256?
HS256 signs and verifies with one shared secret. RS256 and ES256 sign with a private key and verify with a public one that anyone can have.