JWT decoder

{
  "alg": "HS256",
  "typ": "JWT"
}

{
  "iss": "https://auth.example.com",
  "sub": "user_8431",
  "aud": "api.example.com",
  "iat": 1790000000,
  "exp": 1790003600,
  "scope": "read:orders write:orders",
  "email": "jane@example.com"
}

How a JWT is put together

A JSON Web Token (RFC 7519) in its usual signed form is three base64url-encoded parts joined by dots: header.payload.signature. Base64url is ordinary base64 with - and _ in place of + and /, and no padding, so the token is safe in URLs and headers. The header and payload are JSON; the signature is raw bytes computed over the first two parts exactly as they appear, dots included. An encrypted token (JWE) has five parts instead, and its payload cannot be read without the key.

Decoding is just the reverse of that encoding. This page splits the token, decodes each part, parses the JSON, and then reads the claims. Dates in JWTs are NumericDate values: whole seconds since 1 January 1970 UTC, not milliseconds.

The registered claims

Signing algorithms

The alg header names one of the algorithms in RFC 7518 (JWA) or RFC 8037. The practical split is between symmetric HMAC (the HS family), where one shared secret both signs and verifies, and asymmetric signatures, where a private key signs and anyone with the public key can verify.

A worked example

The example token's header is {"alg":"HS256","typ":"JWT"}. Its payload says it was issued by https://auth.example.com for user user_8431, to be used by api.example.com, with the scopes read:orders write:orders.

iat is 1790000000, which is 2026-09-21 14:13:20 UTC, and exp is 1790003600, exactly 3,600 seconds (one hour) later. That is a typical access-token lifetime, and it means the token has long since expired: any correct server would reject it now. The algorithm is HS256, so the API that checks it must hold the same secret as the issuer; for a token accepted by several services an asymmetric algorithm such as ES256 or RS256 would keep the ability to create tokens in one place.

What decoding cannot tell you

Whether the token is genuine. Anyone can write a token with any claims they like; only checking the signature with the right key, and then checking iss, aud, exp and nbf, establishes that it is real and current. Expiry on this page is judged by your device's clock. Claims beyond the registered ones are explained where they are widely used (OAuth scopes, OpenID Connect profile claims), but their meaning is ultimately whatever the issuer decided.