Header
Payload
Tested in November 2026. Decoding, claim dates, expiry status, the alg none note and error messages were tested with sample tokens. The signature is never verified.
How to decode a JWT
- Paste the token into the box. A leading word Bearer is removed for you.
- The header and payload are shown as formatted JSON.
- Read the dates below them. Issued at, not valid before and expires at are shown as dates and times.
- Use Copy header or Copy payload to copy a part.
Tips for better results
- Check the exp date first when a login stops working.
- Look at the alg value in the header to see how the token claims to be signed.
- Use the audience and issuer values to check that a token is meant for your service.
Limits to know about
- The tool reads the token. It does not check the signature, so it cannot tell you the token is genuine.
- Expiry is judged by your device clock. A wrong clock gives a wrong answer.
- Anyone can read the payload of a JWT, so it should not hold secrets.
- Encrypted tokens (JWE) have a different format and cannot be read here.
Privacy
The token is decoded inside your browser and is not sent to ToolsRiver. Still, avoid pasting live production tokens into any website that you do not control.
Frequently asked questions
What is a JWT?
A JSON Web Token is a signed text that carries claims such as who the user is and when the token expires.
Can this tool verify the signature?
No. Verifying needs the secret or public key, which should stay on your server.
Why does it say the token is expired?
The exp time is before the current time on your device.
Is the payload secret?
No. The payload is only encoded, not encrypted, so anyone with the token can read it.
Is it free?
Yes, with no sign-up.
About this tool
ToolsRiver JWT Decoder shows the header, payload and expiry of a JSON Web Token in your browser, without sending it anywhere.