TabBench
Developer & Data100% Free for AllClient-Side PrivateAuto-saved (3 days)

JWT Decoder & Expiration Checker

Debug JWT authentication tokens client-side. Inspect user claims, issuer, algorithm, and check whether the token is expired or valid.

Encoded JSON Web Token
Token Status: Active / Valid
Fri, 15 Jan 2027 07:59:59 GMT
Header: Algorithm & Token Type
{
  "alg": "HS256",
  "typ": "JWT"
}
Payload: Data Claims
{
  "sub": "1234567890",
  "name": "Alex Doe",
  "admin": true,
  "iat": 1516239022,
  "exp": 1799999999
}

A JSON Web Token is three Base64URL-encoded segments separated by dots: a header describing the signing algorithm, a payload of claims, and a signature. The first two are readable by anyone — a JWT is signed, not encrypted. This decoder splits and pretty-prints the header and payload so you can check claims like expiry, issuer, and audience while debugging an auth flow, entirely inside your browser.

How to decode a JWT

  1. Paste the full token, including both dots and all three segments.
  2. Read the decoded header to see the signing algorithm ('alg') and key id ('kid').
  3. Read the payload for the claims that matter: 'exp' for expiry, 'iat' for issue time, 'sub' for subject, 'iss' for issuer, and 'aud' for audience.
  4. Convert the numeric timestamps — they are Unix seconds, not milliseconds — to check whether the token has expired.

The JWT Decoder & Expiration Checker runs entirely in your browser — nothing you enter is uploaded, stored, or logged.

When to use this tool

Diagnosing 401 responses

When an API rejects a token, decoding it usually explains why immediately: the 'exp' claim is in the past, or the 'aud' does not match the service you are calling.

Verifying what an identity provider actually issues

OIDC providers vary in which claims they include. Decoding a real token is faster than reading the documentation to find out whether email or roles are present.

Checking token lifetime during development

Comparing 'iat' and 'exp' shows the configured lifetime, which is useful when a session expires sooner than expected.

Things worth knowing

  • 'exp' and 'iat' are seconds since the Unix epoch. Multiply by 1000 before passing them to JavaScript's Date constructor.
  • An 'alg' value of 'none' is a red flag — it indicates an unsigned token, which no production verifier should accept.
  • Decoding is not verification. A decoded token that looks correct may still have an invalid signature.
  • Never paste a production token belonging to a real user into an online decoder that sends data to a server. This one does not.

Frequently Asked Questions

Is it safe to paste JWT tokens here?

Yes, decoding is performed purely in client JavaScript with no network requests.

Does decoding a JWT verify its signature?

No, and this is the most important thing to understand about JWTs. Decoding only reverses the Base64URL encoding of the header and payload. Verifying the signature requires the issuer's secret or public key and must happen server-side. A token can decode perfectly and still be forged.

Is it safe to paste a token here?

Decoding runs entirely in your browser and the token is never transmitted. That said, treat any live token as a credential — anyone holding it can act as that user until it expires, so avoid pasting production tokens into tools generally, and revoke any token you suspect has been exposed.

Why is my JWT payload readable by anyone?

Because signed JWTs are designed for integrity, not confidentiality. The signature proves the payload was not altered; it does not hide it. Never place passwords, full card numbers, or other secrets in JWT claims. If you need confidentiality, use JWE rather than JWS.

What do the standard claim names mean?

'iss' is the issuer, 'sub' the subject (usually a user id), 'aud' the intended audience, 'exp' the expiry time, 'nbf' the earliest valid time, 'iat' the issue time, and 'jti' a unique token id. Anything else is a custom claim defined by whoever issued the token.

Why does my token have only two segments?

An unsecured JWT with 'alg: none' has an empty signature, producing a trailing dot with nothing after it. More often, a two-segment token means the string was truncated in transit — check for a length limit in whatever logged or copied it.

Related Tools

Developer & Data

Base64 Encoder / Decoder

Encode text or decode Base64 strings instantly with live UTF-8 support and URL-safe mode.

Use tool
Developer & Data

UUID / GUID Generator

Generate cryptographically secure Version 4 UUIDs (GUIDs) in bulk with uppercase, hyphen, and quote formatting.

Use tool
Developer & Data

JSON Formatter & Validator

Format, validate, prettify, minify, and inspect JSON payloads with real-time error detection.

Use tool