Debugging auth
See why an API rejects a token: wrong audience, missing claim or expired.
JWT Decoder
See what is inside a JWT. This tool only decodes the token, it does not verify it, and nothing is sent anywhere.
Your files stay with you. Your files never leave your browser. This tool runs on your device: nothing is uploaded to our servers, so there is nothing for us to store or see.
How to use it
- Paste your token (a leading Bearer is fine).
- Read the header, payload and the dates for iat, nbf and exp.
- Copy any part you need.
Where it helps
Checking expiry
Find out exactly when a session or access token runs out.
Learning JWTs
See how claims are laid out in real tokens.
Good to know
Stays in your browser
Your text and files are processed on your device and never sent to our servers.
A token is a credential
Prefer test tokens; never share live ones.
Always verify server-side
Decoding proves nothing about who issued it.
Questions people ask
How do you decode a JWT to see its header, payload and expiry?
Paste the token; a leading 'Bearer' is fine. The tool shows the header and payload as formatted JSON and turns the iat, nbf and exp timestamps into dates in UTC and India time, so you can see when the token was issued and when it expires. It decodes only: it doesn't verify the signature, and nothing is sent anywhere.
- Header And payload. As JSON.
- exp iat, nbf. As readable dates.
- IST And UTC. Both shown.
- Decode only No verification. Verify on your server.
Does this verify the token?
No. It only decodes the header and payload, which are plain Base64URL-encoded JSON that anyone can read. It can't tell you the token is genuine, because verifying needs the secret or public key that signed it. Always verify signatures on your server before trusting any claim inside a token.
Is it safe to paste a real token?
The token is decoded in your browser and isn't sent to us. Even so, a live token is a credential: anyone who has it can act as the user until it expires. Prefer test tokens, never share production tokens publicly, and close the tab when you're done on a shared computer.
What do exp, iat and nbf mean?
exp is when the token expires, iat is when it was issued and nbf is the time before which it mustn't be accepted. They're Unix timestamps in seconds, which the tool shows as readable dates in UTC and India time. Most token problems come down to one of these three values.
Why can't it read my encrypted token?
Tokens with five parts separated by dots are JWE, which means encrypted tokens. Their content is hidden without the decryption key, so the tool says so instead of guessing. A normal signed JWT, called JWS, has three parts, and its header and payload can be decoded by anyone.
What is a JWT?
A JSON Web Token is a compact string with three parts separated by dots: a header, a payload of claims and a signature. Apps use them to prove who a user is between requests, often in an Authorization header. The payload is readable by anyone, so it must never hold secrets.
Why is my API rejecting a token?
Decode it and check the claims. Common causes are an expired exp, a wrong aud (audience) or iss (issuer), a missing scope or role, or an nbf in the future because of a clock difference. If the claims look right, the signature or signing key may be the problem.
What are aud, iss and sub?
iss is who issued the token, aud is who it's meant for and sub is the subject, usually the user ID. Servers check iss and aud to make sure a token from one system can't be used in another. The decoder shows them in the payload along with any custom claims.
Can I paste a token with 'Bearer' in front?
Yes. A leading 'Bearer' and the space after it are removed for you, so you can copy the whole Authorization header value from your browser's developer tools or an API client. Make sure you copy the full token, as long tokens are easy to cut off.
What does alg in the header mean?
alg names the signing algorithm, such as HS256 (a shared secret) or RS256 (a private key with a public key to check). Servers should only accept the algorithms they expect, and never 'none'. Seeing an unexpected algorithm in a token is worth investigating. Your auth library should enforce this.
Should I store tokens in local storage?
It's common but risky, because any script on the page, including injected ones, can read local storage. Many teams prefer secure, HTTP-only cookies for session tokens. Whichever you choose, keep tokens short-lived and protect the site against cross-site scripting. Ask your security reviewer which approach fits your app and its users best.
Can I edit a token here?
No, and editing wouldn't help: changing the payload breaks the signature, so a properly built server rejects it. That's the point of signing. To test different claims, ask your auth system to issue a new token, or create test tokens with your server's development keys.
Why are times shown in India time?
Token timestamps are in UTC, which is easy to misread. The tool shows each date in UTC and in India Standard Time, five and a half hours ahead, so you can see at a glance whether a token expired a minute ago or will expire later today.
Is the token stored?
No. Decoding happens in your browser, nothing is sent to our servers and nothing is saved when you close the page. Still treat any real token as a password: avoid pasting live production tokens into any website, and revoke a token if you think it has leaked.
Does it work on a phone?
Yes. Paste a token on your phone to read its claims and expiry. Long tokens are fiddly to copy on a phone, so check you've got all of it. Everything runs in your mobile browser, with no app and no upload, so it's fine for a quick check.
Is the JWT decoder free?
Yes. It's free with no sign-up and no limit on use. It's one of the free developer tools from Marketiism, along with the Base64 tool, the JSON formatter and the timestamp converter. Marketiism builds software for small businesses. Use it as often as you need, for any project.
Want this inside your own account?
Marketiism keeps your invoice numbers, GST reports, UPI payment links and WhatsApp reminders in one place. Leave your details and we'll call to set it up for your business, or start the trial yourself.
More Developer tools
Base64 Encode and Decode
Encode text to Base64 or decode Base64 back to text, with URL-safe mode.
JSON Formatter
Format, validate and minify JSON, and see exactly which line has a mistake.
Unix Timestamp Converter
Convert Unix timestamps to dates and dates to timestamps, with India time.
JSON to CSV
Turn a JSON list of records into CSV for Excel or Google Sheets.
CSV to JSON
Convert CSV rows into a JSON list, with numbers and true/false detected.
YAML to JSON
Convert YAML config files into JSON and catch indentation mistakes.