JWT Decoder and Encoder

Paste a JSON Web Token to read its header and claims, check when it expires and verify the signature. Your token never leaves this page.

JWT decoder and encoder

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkphbmUgRG9lIiwiYWRtaW4iOnRydWUsImlhdCI6MTc2NzIyNTYwMCwiZXhwIjoxODkzNDU2MDAwfQ.vgHtS5dyaSUxDoPpQPoyaFVrg5I8B0EV9R0_Ah59pxU

Header

{
  "alg": "HS256",
  "typ": "JWT"
}

Payload

{
  "sub": "1234567890",
  "name": "Jane Doe",
  "admin": true,
  "iat": 1767225600,
  "exp": 1893456000
}

Algorithm (alg): HS256
Type (typ): JWT
Subject (sub): 1234567890
Issued at (iat): Thursday, January 1, 2026 at 9:00:00 AM GMT+9
Expires (exp): Tuesday, January 1, 2030 at 9:00:00 AM GMT+9

ShareX Facebook Reddit

Add this calculator to your website

Copy the code and paste it into your page's HTML. It's free; please keep the credit link.

<iframe src="https://calcmint.pages.dev/embed/en/jwt-decoder/" title="JWT Decoder and Encoder" loading="lazy" style="width:100%;height:600px;border:0"></iframe>
<p style="margin:4px 0 0;font-size:12px">JWT Decoder and Encoder · <a href="https://calcmint.pages.dev/jwt-decoder/">CalcMint</a></p>
<script>addEventListener("message",function(e){if(e.origin=="https://calcmint.pages.dev"&&e.data&&e.data.calcmintHeight)for(var f of document.querySelectorAll("iframe"))if(f.contentWindow==e.source)f.style.height=e.data.calcmintHeight+"px"})</script>

How a JWT is built

A JSON Web Token (RFC 7519) is three Base64URL strings joined by dots: header.payload.signature. The header says which algorithm signed it, the payload holds the claims (user ID, roles, expiry) and the signature is computed over the first two parts.

With HS256 the signature is an HMAC made with a shared secret, so the same secret signs and verifies. RS256, PS256 and ES256 use a private key to sign and a public key to verify, which lets many services check tokens without being able to create them.

Checking a token safely

Always verify the signature on the server and reject alg "none".
Pin the expected algorithm: don't let the token's header pick it.
Check exp, nbf, iss and aud, allowing a minute or two of clock skew.
Keep tokens short-lived, and treat a pasted token like a password: this decoder works offline, but many online ones send it to a server.

Registered JWT claims (RFC 7519)

Claim	Name	Meaning
`iss`	Issuer	Who created and signed the token
`sub`	Subject	Who the token is about, usually a user ID
`aud`	Audience	Who the token is meant for
`exp`	Expiration time	Seconds since 1970 after which it must be rejected
`nbf`	Not before	Seconds since 1970 before which it must be rejected
`iat`	Issued at	When it was created
`jti`	JWT ID	Unique ID, to stop a token being replayed

Frequently asked questions

Can anyone read a JWT?

Yes. The header and payload are only Base64URL-encoded, not encrypted, so anyone holding the token can read them. Never put passwords or secrets in a JWT payload.

Does decoding a JWT check that it's valid?

No. Decoding just reads the contents. Only verifying the signature with the right secret or public key proves the token wasn't forged or changed, and the server must also check exp, nbf and aud.

Why is my token expired when it was just issued?

exp, iat and nbf are in seconds since 1970, not milliseconds. A token built with JavaScript's Date.now() (milliseconds) without dividing by 1000 looks like it expires tens of thousands of years from now, while clock differences between servers can make a fresh token look expired or not yet valid.

Is what I paste sent to a server?

No. This tool runs entirely in your browser with JavaScript and the built-in Web Crypto API. Nothing you type, paste or open is uploaded or stored.

Related calculators

Base64 encode/decode JSON formatter Unix timestamp