About the JWT Decoder
Tezmy's JWT Decoder shows what's inside a JSON Web Token. Paste a token (with or without “Bearer”) to see its header and payload as neatly formatted JSON, plus human-readable issued-at, not-before and expiry dates and a clear expired / not expired status. Tokens often contain user IDs, emails and permissions, so decoding happens entirely in your browser and nothing is sent to any server. Remember that decoding doesn't verify the signature.
Updated October 2026
How to use the JWT Decoder
- 1Paste your JWT into the box.
- 2Read the header and payload as formatted JSON.
- 3Check the issued, not-before and expiry dates.
- 4Copy the header or payload if you need them.
The three parts of a JWT
A JSON Web Token is three pieces joined by dots: header.payload.signature. The header says which algorithm signed the token. The payload holds the claims, like the user ID, roles and expiry time. The signature proves the token wasn't changed, but only the server with the key can check it.
Common claims explained
- sub: the subject, usually the user ID.
- iat: issued at, when the token was created.
- exp: expiry time, after which it should be rejected.
- nbf: not before, the earliest time it's valid.
- iss and aud: who issued the token and who it's meant for.
Debugging login problems
If an app suddenly logs users out or an API returns 401, paste the token here and check the expiry date first: expired tokens are the most common cause. Also check that the audience, issuer and roles are what your server expects. Times are shown in your local time and UTC.
Decoding is not verifying
Anyone can decode a JWT, because the payload is only Base64-encoded, not encrypted. Never put secrets in a token, and always verify the signature on your server before trusting it. Decoding here happens in your browser, so tokens aren't sent anywhere. Decoding a token often leads to the next question. The Base64 Encoder & Decoder shows how the readable parts of a token are stored, the Unix Timestamp Converter turns the exp and iat numbers into real dates, and the JSON Formatter makes a long payload easier to read.
Features
- Header and payload as pretty JSON
- Readable iat, nbf and exp dates
- Expired / not expired status
- Accepts “Bearer …” tokens
- Clear errors for malformed tokens
- Private: decoded in your browser
Frequently asked questions
What is a JWT?
A JSON Web Token is a compact, signed way to pass information such as who a user is. It has three Base64URL parts separated by dots: header, payload and signature.
Does decoding verify the token?
No. Anyone can decode a JWT; that's why you should never put secrets in the payload. Verifying the signature needs the secret or public key and should happen on your server.
What do iat, nbf and exp mean?
iat is when the token was issued, nbf is the time before which it must not be accepted, and exp is when it expires. They're Unix timestamps in seconds, shown here as normal dates.
Is it safe to paste my token here?
Decoding runs entirely in your browser and the token is never sent anywhere. Still, treat live tokens like passwords and don't share them.
Why does it say the token is malformed?
A JWT must have exactly three parts separated by dots, and the first two must be Base64URL-encoded JSON. Extra spaces, missing parts or copy mistakes cause this error.
Can I edit a JWT here?
No. Changing the payload would break the signature, and the server would reject the token. This tool is for reading tokens only.
Why is my token's expiry time in the past?
The token has expired. Log in again or use your app's refresh token to get a new one.
Is it free?
Yes. Free, no sign-up, and nothing is stored.
Does it work with “Bearer” tokens?
Yes. Paste the whole Authorization value; the word Bearer is removed automatically.
Can I decode a JWT on my phone?
Yes. Paste the token in any mobile browser to see its contents.