a eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyXzQxODIiLCJuYW1lIjoiQWRhIExvdmVsYWNlIiwiZW1haWwiOiJhZGFAZXhhbXBsZS5jb20iLCJyb2xlIjoiYWRtaW4iLCJpYXQiOjE3NjcyMjU2MDAsImV4cCI6MTc2NzIyOTIwMH0.ExpGuE2lD01jZibyg42gcODvJDKgJPw2GnOh6-XF4IAJWT Decoder
Paste a token and press Decode JWT in the Convert panel.
Skip to editor
a polyxmedia product
JSONUTF-8
Spaces: 2
How do I decode a JWT?
To decode a JSON Web Token, paste it above, open Convert and press Decode JWT. The header and payload open in a new tab as formatted JSON, with iat and exp turned into readable dates and a flag that says whether the token has expired. A leading Bearer is stripped for you.
Decoding only reads the token, it doesn't verify the signature, so never trust a decoded token without checking it on your server. Since tokens often grant access to real accounts, this decoder runs entirely in your browser and the token is never sent anywhere.
- Paste the token into the editor.
- Open Convert and press Decode JWT.
- Read the header and payload in the new tab.
Example
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyXzQxODIiLCJuYW1lIjoiQWRhIExvdmVsYWNlIiwiZW1haWwiOiJhZGFAZXhhbXBsZS5jb20iLCJyb2xlIjoiYWRtaW4iLCJpYXQiOjE3NjcyMjU2MDAsImV4cCI6MTc2NzIyOTIwMH0.ExpGuE2lD01jZibyg42gcODvJDKgJPw2GnOh6-XF4IA{
"header": {
"alg": "HS256",
"typ": "JWT"
},
"payload": {
"sub": "user_4182",
"name": "Ada Lovelace",
"email": "ada@example.com",
"role": "admin",
"iat": 1767225600,
"exp": 1767229200
},
"signature": "ExpGuE2lD01jZibyg42gcODvJDKgJPw2GnOh6-XF4IA",
"issuedAt": "2026-01-01T00:00:00.000Z",
"expiresAt": "2026-01-01T01:00:00.000Z",
"expired": true
}Questions people ask
Is it safe to paste a JWT here?
Decoding happens in your browser with no request made, so the token stays on your machine. As a habit, prefer expired or test tokens when you paste them into any tool.
Does this verify the signature?
No, verifying needs the secret or public key, and that belongs on your server. This shows what the token claims, which is what you need for debugging.
What do iat and exp mean?
iat is when the token was issued and exp is when it expires, both as seconds since 1970. The decoder shows them as ISO dates next to the raw values.