JWT Decoder

Paste a JSON Web Token to see its header and payload as formatted JSON, the signing algorithm, and when it was issued and expires. Decoding only: the signature is not verified, and the token never leaves your browser or goes into the link.

JWT

Paste the token; a leading Bearer is ignored.

Algorithm

HS256

Type: JWT
Issued at (iat): 2026-10-29 08:00:00 UTC
Expires (exp): 2026-10-29 09:00:00 UTC

Working: The header and payload base64url-decoded and parsed as JSON; the signature is not checked; algorithm HS256

Signature not verified. This only decodes the token. Anyone can write a token that decodes like this one, so never trust its contents until your server has checked the signature with the key.

Header

{
  "alg": "HS256",
  "typ": "JWT"
}

Payload

{
  "sub": "user-1042",
  "name": "Example User",
  "role": "editor",
  "iat": 1793260800,
  "exp": 1793264400,
  "iss": "https://auth.example.com"
}

Signature (43 characters): r5Tq0b9yQx4kV2mJm1cZ3nB8s7uW6eA0dF9gH2iJ3kL

Decoded in your browser. The token is not sent anywhere, not stored, and never put in the link.

Try:

Frequently asked questions

Does this verify the signature?

No. It only decodes the header and payload, which are base64url-encoded JSON that anyone can read and anyone can write. Verifying needs the secret or public key and should happen on your server. Never trust a token's claims just because they decode.

Is it safe to paste a real token here?

The token is decoded by JavaScript in your browser. It is not sent to Qivtools or anyone else, not stored and never written into the address, so Copy link shares an empty decoder. Still, a live token is a password: prefer expired or test tokens, and revoke one you have pasted somewhere you do not trust.

What do iat, nbf and exp mean?

They are times in seconds since 1 January 1970 UTC: iat is when the token was issued, nbf the moment before which it must not be accepted, and exp when it expires. They are shown in UTC and in your local time, and the expiry line says how long ago or how soon.

Why does my token have five parts?

Five dot-separated parts make an encrypted token (JWE). Its payload is encrypted, so it cannot be read without the key. Signed tokens (JWS), the common kind, have three parts.