JWT Decoder

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkFkYSBMb3ZlbGFjZSIsInJvbGUiOiJhZG1pbiIsImlhdCI6MTcwMDAwMDAwMCwiZXhwIjoxNzAwMDAzNjAwfQ.pBSHJDXCRuBqZrds3AJ_St-OREr2Ma5GW9qHdm8EJik

HEADER
{
  "alg": "HS256",
  "typ": "JWT"
}

PAYLOAD
{
  "sub": "1234567890",
  "name": "Ada Lovelace",
  "role": "admin",
  "iat": 1700000000,
  "exp": 1700003600
}

Alongside the JSON, the decoder shows Issued: Tue, 14 Nov 2023 22:13:20 GMT and Expires: Tue, 14 Nov 2023 23:13:20 GMT, and marks this token as expired.

A JWT (RFC 7519) has three parts separated by dots: header.payload.signature.

1. Header. JSON naming the signing algorithm (alg) and usually the type (typ). It may also include kid, the ID of the key used to sign it.
2. Payload. JSON with the claims: who the token is about, who issued it, what it allows and when it expires.
3. Signature. Computed over the first two parts with a secret or a private key. It proves the token hasn't been changed, but it does not hide anything.

The header and payload are only Base64URL-encoded, not encrypted. Anyone who has the token can read them, which is why a JWT must never contain passwords or other secrets. (Encrypted tokens, JWE, have five parts instead of three and can't be read without the key.)

Times are in seconds since 1970. To convert one by hand, use the Unix timestamp converter.

1. Paste the token. A leading Bearer is fine, and so is a token without a signature.
2. Read the decoded header and payload.
3. Check the algorithm and the expiry line. Remember that decoding doesn't verify the signature.

const token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkFkYSBMb3ZlbGFjZSIsInJvbGUiOiJhZG1pbiIsImlhdCI6MTcwMDAwMDAwMCwiZXhwIjoxNzAwMDAzNjAwfQ.pBSHJDXCRuBqZrds3AJ_St-OREr2Ma5GW9qHdm8EJik";
const [header, payload] = token.split(".").slice(0, 2)
  .map((part) => JSON.parse(Buffer.from(part, "base64url").toString("utf8")));
console.log(header.alg, payload.sub, new Date(payload.exp * 1000).toISOString());

import base64, json

token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkFkYSBMb3ZlbGFjZSIsInJvbGUiOiJhZG1pbiIsImlhdCI6MTcwMDAwMDAwMCwiZXhwIjoxNzAwMDAzNjAwfQ.pBSHJDXCRuBqZrds3AJ_St-OREr2Ma5GW9qHdm8EJik"
payload = token.split(".")[1]
payload += "=" * (-len(payload) % 4)  # restore Base64 padding
print(json.loads(base64.urlsafe_b64decode(payload)))

To verify a token in production, use a maintained library such as jose (JavaScript) or PyJWT (Python) and pin the expected algorithm.