JWT decoder
See what’s inside a JSON Web Token, and whether it has expired.
A “Bearer ” prefix, quotes and line breaks are removed for you
Report a problem with this tool
How to use JWT decoder
Paste your token
Paste a JWT. A “Bearer ” prefix, quotes and line breaks are removed for you.
Read the parts
The header, payload and signature are colour-coded, and the header and payload are shown as tidy JSON.
Check the claims
Standard claims are explained, times are shown as dates, and a badge says whether the token is still valid.
Why use Utils365
Expiry at a glance
See “Expired 2 hours ago” or “expires in 3 days” instead of working out exp and iat by hand.
Claims in plain words
iss, sub, aud, exp, nbf, iat and jti are each explained, so you know what the token says about its user.
Clear errors
If a token is cut short or damaged, you’re told which part failed. Encrypted tokens are recognised too.
Private by design
Decoding happens in your browser, so the token you paste is never sent to us or anyone else.
Frequently asked questions
What is a JWT?
A JSON Web Token is a compact, signed piece of text that apps use to say who you are, often sent as “Authorization: Bearer …”. It has three parts separated by dots: a header, a payload of claims, and a signature.
Is a JWT encrypted?
Usually not. The header and payload are only Base64URL-encoded, so anyone who has the token can read them. Never put passwords or secrets in a JWT’s payload.
Does this check the signature?
No. It decodes the token so you can read it. Checking the signature needs the secret or public key, and should be done by the server that accepts the token.
Is it safe to paste a token here?
Decoding happens entirely in your browser and nothing is uploaded. Even so, treat a live token like a password: avoid pasting production tokens anywhere unless you can revoke or rotate them.
How do I know when a JWT expires?
Look at the exp claim. It’s a Unix timestamp in seconds, which this tool shows as a date along with how long is left, or how long ago it expired.
Why does my token have five parts?
That’s an encrypted token (JWE). Its contents can only be read with the key it was encrypted for, so it can’t be decoded here.