developer desk · jwt decoder
Read a JWT, and see when it expires.
Paste a JSON Web Token to read its header and payload and see its timestamps as dates. Nothing is sent anywhere — the token is read in this tab.
The signature is not checked. Checking it needs the key, and this page does not ask for one — so what is shown here is what the token claims, not proof that it is genuine.
Once the token is read
Each part of a token is Base64URL. To decode or make one part by hand, the encoder takes it directly.
Encode or decode Base64URLQuestions
Does a token that decodes here mean it is valid?
No. Anybody can write a token that decodes. Whether it is genuine depends on the signature, and checking that needs the key — which a web page should not ask you for. This page reads what the token claims and says that it did not check it.
What are iat, nbf and exp?
Three registered claims from RFC 7519, each a number of seconds since 1 January 1970: when the token was issued, the moment before which it must not be accepted, and when it expires. The page shows each as a date and says whether it has passed.
Why does a five-part token not decode?
Because it is encrypted (a JWE). Its payload is ciphertext, and reading it needs the key.