Dev Utilities
Decode a JWT into its header and payload
The JWT decoder takes a JSON Web Token and prints its header and payload as formatted JSON after Base64URL-decoding each part. Developers debugging an auth flow use it to inspect the alg and typ a token advertises and to read claims such as sub, iat and exp. Time claims are also shown as UTC dates with how long ago or ahead they are, so you can see at a glance whether a token has expired. The signature is shown but not verified, and a leading Bearer from an Authorization header is ignored.
How to use JWT Decoder
- Open JWT Decoder in the Toolbox101 app.
- Paste the token into the
JWTbox: three Base64URL parts separated by dots. A leadingBeareris ignored. - Read the
Outputbox: the header, the payload, aTimes (UTC)section when the token hasiat,nbforexp, and the signature, marked as not verified. - Click
Copyto take the decoded token into a ticket, test assertion or debug log.
Worked example
JWT Decoder returns the output below for this input.
Input
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5cOutput
Header:
{
"alg": "HS256",
"typ": "JWT"
}
Payload:
{
"sub": "1234567890",
"name": "John Doe",
"iat": 1516239022
}
Signature (not verified): SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5cThe tool also prints a Times (UTC) section that turns iat (here 2018-01-18 01:30:22 UTC) into a date and says how long ago that was. The relative wording depends on today's date, so it is left out here.
Check it yourself: open JWT Decoder and enter the same input.
Frequently asked questions
Does it check the signature on my JWT?
No. The signature is shown, labelled as not verified, but nothing checks that the token was really signed by the party you expect. Treat the decoded claims as unverified until you validate the signature against the issuer's key, for example by recomputing the HMAC over the first two parts with the HMAC-SHA256 tool.
Can I decode a JWT without the secret key?
Yes. The header and payload are plain Base64URL-encoded JSON, so anyone holding the token can read them; the secret is only involved in creating and verifying the signature. That is why a token must never carry sensitive data such as passwords, and why this decoder needs no key.
What do exp, iat and nbf mean?
exp is when the token expires, iat when it was issued and nbf the earliest time it is valid, all in seconds since the Unix epoch. The tool converts each to a UTC date and says whether it is in the past or the future, such as expired 2 days ago or expires in 3 hours. A server should reject a token whose exp has passed.
What does it do with a malformed token?
A JWT has exactly three parts separated by dots, and the header and payload must be Base64URL-encoded JSON. If a part is not, the Output box names the part that is wrong instead of printing noise.
How is this different from the Base64URL decoder?
The Base64URL Decode tool decodes one string at a time. This tool splits the token, decodes the header and payload, parses them as JSON and pretty-prints them, and adds the time claims and the signature, so you can paste the whole token in one go.