What is inside a JWT
A JSON Web Token (RFC 7519) is three base64url strings joined by dots: header.payload.signature. Base64url, defined in RFC 4648 section 5, is ordinary Base64 with - and _ in place of + and /, and with the trailing = padding removed. This decoder restores the padding, decodes each of the first two parts as UTF-8 text, parses them as JSON and pretty-prints them. Nothing is calculated with a key, because decoding needs none.
Worked example
The header segment eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9 decodes to {"alg":"HS256","typ":"JWT"}. A payload containing "iat":1516239022 and "exp":1516242622 is reported as:
exp: Thu, 18 Jan 2018 02:30:22 GMT (expired)
iat: Thu, 18 Jan 2018 01:30:22 GMTThe two numbers are Unix seconds, exactly one hour apart, so the token lived for 3,600 seconds.
| Claim | Meaning | Shown by this tool |
|---|---|---|
exp | Expiry time | UTC date plus "expired" or "valid" |
iat | Issued at | UTC date |
nbf | Not valid before | UTC date |
sub, iss, aud | Subject, issuer, audience | Visible in the payload JSON only |
What "valid" does and does not mean
The "(valid)" label only compares exp with your computer's clock. It says nothing about the signature, the issuer or the audience. Anyone can write a payload and put any expiry in it, and only your server, holding the key, can tell a genuine token from a forged one. Never make an authorisation decision from decoded contents. Also note that the payload is encoded, not encrypted, so keep secrets such as passwords out of it.
Why a token may fail to decode
- A leading
Bearerprefix copied from an Authorization header is stripped for you, and spaces or line breaks inside the token are ignored. - Only the first two segments are read, so a truncated token with a missing signature still decodes.
- Encrypted tokens (JWE) have five segments and cannot be read without the key, so the tool tells you that instead of showing claims. Any other number of dot-separated parts is reported with the count it found, and a part that is not valid base64url or JSON is named in the error.
- Claims are only interpreted as dates when they are JSON numbers. A string such as
"1516242622"is shown but not converted.
To see how a token is assembled, build one with the JWT encoder. To inspect an individual segment by hand, use Base64 decode.