How to Decode a JWT
A JSON Web Token is three base64url-encoded parts joined by dots: a header describing how it was signed, a payload carrying the claims, and a signature over both. Decoding it tells you who issued it, who it is about, what it permits and when it stops working — which is usually all you need when something is returning 401 and you are trying to work out why.
Paste the token
With or without a Bearer prefix. It decodes as you type, entirely on your device.
Read the claims
Each standard claim is explained, and timestamps are shown as real dates with how long ago they were.
Check the expiry
The status panel tells you immediately whether the token is still live, which is the usual reason for looking.
Decoding Is Not Verifying
This distinction causes real security incidents, so it is worth being precise about. Decoding reads the token — anyone can do it, no key required, because a JWT is encoded rather than encrypted. Verifyingchecks the signature against the issuer's key and proves the payload has not been tampered with. A token that decodes perfectly may still be forged.
The practical consequence: never trust a claim you have only decoded. If your server reads role: adminfrom a token without verifying the signature, an attacker simply edits the payload, re-encodes it, and becomes an administrator. Verification is not optional, and it needs the secret or public key — which is exactly why this tool never asks for one. A tool that offered to verify would be asking you to paste your signing key into a web page.
One related trap worth knowing: the none algorithm. Early JWT libraries would honour a header claiming alg: none and skip verification entirely, which made forgery trivial. Modern libraries reject it, but if you ever see it in a real token, treat it as a serious finding rather than a curiosity.
What the Standard Claims Mean
exp, iat and nbf are Unix timestamps
Seconds since 1970, not milliseconds. They are shown here as readable dates because raw epoch numbers tell you nothing at a glance.
sub identifies the user
Usually an internal user ID rather than an email, so that the token survives the user changing their address.
iss and aud are a matched pair
Who issued the token and who it is for. A correctly implemented server checks both, since a valid token for another service should not be accepted.
Everything else is issuer-specific
Roles, scopes, permissions, tenant IDs - these are custom claims and vary entirely by system. Only the registered ones have defined meanings.
Frequently Asked Questions
How do I decode a JWT?
Paste it and the header, payload and claims appear immediately, with every standard claim explained and expiry checked.
Is my token sent to a server?
No, and this matters more here than almost anywhere else. A JWT is a live credential, and decoding happens entirely in your browser.
Is a JWT encrypted?
No. It is base64url encoded, which anyone can reverse. The signature proves the contents have not been altered - it does not hide them.
Can this tool verify the signature?
No, deliberately. Verification needs the issuer's secret or public key, and a web page should never ask you to paste that.
How do I know if a token has expired?
The status panel reads the exp claim and compares it to now, showing whether the token is live and how long remains.
Why is my exp claim a huge number?
It is a Unix timestamp - seconds since 1970. It is shown here as a readable date alongside the raw value.
What is the difference between decoding and verifying?
Decoding reads the token, which anyone can do. Verifying proves it was signed by who it claims and has not been tampered with.
What does alg none mean?
An unsigned token. Old libraries would accept it and skip verification, making forgery trivial. Seeing it in production is a serious finding.
Why does my token have only two parts?
Some unsigned tokens omit the signature. It will decode here, but a token without a signature proves nothing about its origin.
What is the sub claim?
The subject - who the token is about, usually an internal user ID rather than an email address.
Should I paste a production token here?
It is decoded locally and never transmitted, so it is as safe as opening it in your own editor. Treat it as a credential regardless until it expires.
Is this JWT decoder really free?
Completely free, with no limits, no signup and no premium wall. Everything runs in your browser.
Last updated: July 21, 2026 · FlipMyFormat JWT Decoder
Written and maintained by the FlipMyFormat team