JWT Decoder guide
How to Decode JWT Claims and Check Expiration Dates
Inspect a JSON Web Token’s header, payload and time claims. Understand expiration, malformed tokens and why decoding does not verify authenticity.
Open JWT Decoder →Before you start
- Use a three-part token with a JSON header and payload. Encrypted five-part JWE tokens are not supported by this decoder.
- Prefer the built-in sample when learning. A real bearer token may grant access; do not include private tokens in screenshots, URLs or feedback.
Step-by-step instructions
- Open the JWT Decoder and paste a token into Encoded token, or choose Sample to inspect a demonstration.
- Click Decode JWT. Review the decoded header and payload as separate JSON objects.
- Inspect the claims table. Numeric exp, iat and nbf values are interpreted as Unix seconds.
- Read timing status alongside the Signature not verified notice. An unexpired claim is not proof that the application should accept the token.
- Copy the header, payload or combined JSON, or download the decoded result if needed. Clear the input when finished.
Understand exp, iat and nbf
exp gives the expiration time, iat gives the issued-at time and nbf gives the not-before time. Their numeric time values use Unix seconds. Missing or malformed time claims need interpretation according to the application’s rules.
For the example below, exp corresponds to November 14, 2023 at 22:13:20 UTC. Convert the numeric claim using Seconds in the timestamp tool if you need another date representation.
Example decoded payload:
{"sub":"demo-user","exp":1700000000}
Expiration in UTC:
2023-11-14T22:13:20.000ZDecoding is separate from signature verification
The header and payload are encoded data that can be read without a signing key. Reading them does not establish who created the token or whether it has been altered. Any displayed identity, role or issuer remains untrusted until application verification succeeds.
The receiving application must verify the signature using an appropriate trusted key and enforce its algorithm, issuer, audience and time rules. This tool does not perform that verification, generate signed tokens or decide whether access should be granted. Timing status uses the browser clock, which may differ from a server’s clock.
Troubleshooting
The decoder reports an invalid JWT
Check the three dot-separated parts and whether the token was truncated. The header and payload must decode to supported UTF-8 JSON objects.
A five-part token is rejected
It may be an encrypted JWE. This decoder cannot decrypt it; use the application’s authorized decryption tooling.
The token looks unexpired but my API rejects it
Signature verification, audience, issuer or other application rules may fail. Browser and server clocks can also differ. Diagnose the API’s verification result rather than trusting decoded claims.
Privacy and cleanup
Decoding occurs locally without uploading the token. A token can still be exposed if you copy it into another service, share a screenshot or download it to an insecure location. The tool does not save a token history.
Read the Privacy Policy for site preferences, optional analytics and hosting information.
Related tools and guides
Use JWT Decoder with the steps above, or continue with a related task.
Technical references
These references explain the underlying formats or browser behavior. The steps above describe the current AnyUtils tool.