JWT Decoder: View Header, Payload, and Expiry

How this JWT decoder reads a token

A JSON Web Token packs three pieces of data into one string: a header, a payload, and a signature. This decoder splits an encoded token into those three parts, converts the header and payload back into readable JSON, and pulls out the algorithm, issue date, and expiration so you can inspect a token without writing any code.

Header, payload, and signature

A token is split into three parts by two dots: header.payload.signature. Each of the first two parts is base64url-encoded JSON, so decoding them is a reversible operation, not encryption. The header states the signing algorithm, the alg claim, for example HS256 or RS256, and the token type. The payload carries the claims: a subject identifier, any custom data, and usually iat (issued-at) and exp (expiration) timestamps stored as Unix seconds. The signature is a cryptographic value computed from the header and payload. Confirming it requires the secret or private key that created it, so reading a token's contents is a separate operation from verifying that it is genuine. Some tokens are signed with alg set to none and only have two parts, header.payload, since there is nothing left to sign; the decoder accepts that shorter form too and simply leaves the signature segment empty.

Worked example

Paste a token like the one below and it separates into three colored segments, then renders the header and payload as formatted JSON.

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMDI5Mzg0NzU2IiwibmFtZSI6IkdyYWNlIEhvcHBlciIsImlhdCI6MTcxMDUwNDAwMCwiZXhwIjoxNzE4MjgwMDAwfQ.DBids3CUIFu46fZcRQ-OPe-OP-w

{
  "alg": "HS256",
  "typ": "JWT"
}

{
  "sub": "1029384756",
  "name": "Grace Hopper",
  "iat": 1710504000,
  "exp": 1718280000
}

The Algorithm badge reads HS256 from the header. The iat value converts to 15 March 2024 and the exp value converts to 13 June 2024, so the Status badge shows EXPIRED once that date is in the past. None of this happens on a server: the decoding runs in the browser, and the tool never checks whether the signature is genuine, because it has no access to the secret or key that created it.