JWT Decoder

Paste a JSON Web Token to read its header and claims and check expiry. Decoding happens in this tab; the token is never sent, stored or logged.

Tier 0 · browser · unlimited

Encoded token

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyXzJ4OWtRM21McDciLCJwbGFuIjoicHJvIiwicmVnaW9uIjoiQlIiLCJpYXQiOjE3OTE5OTg4MDAsImV4cCI6MTc5MjAwNjAwMCwiaXNzIjoiaHR0cHM6Ly9jbGVyay51dGlsbmVzdC5pbyJ9.N7xkQ2vL0mJ8yfZtHcR4wT1sPq6aUd3eGh9bVn2oKlM

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyXzJ4OWtRM21McDciLCJwbGFuIjoicHJvIiwicmVnaW9uIjoiQlIiLCJpYXQiOjE3OTE5OTg4MDAsImV4cCI6MTc5MjAwNjAwMCwiaXNzIjoiaHR0cHM6Ly9jbGVyay51dGlsbmVzdC5pbyJ9.N7xkQ2vL0mJ8yfZtHcR4wT1sPq6aUd3eGh9bVn2oKlM

Header

HS256

{
  "alg": "HS256",
  "typ": "JWT"
}

Payload

6 claims

{
  "sub": "user_2x9kQ3mLp7",
  "plan": "pro",
  "region": "BR",
  "iat": 1791998800,
  "exp": 1792006000,
  "iss": "https://clerk.utilnest.io"
}

Claim	Value	Meaning
sub	user_2x9kQ3mLp7	Subject — who the token is about
plan	pro	Custom claim
region	BR	Custom claim
iat	1791998800	Issued at · Oct 14, 2026, 5:26:40 PM UTC · 20 minutes ago
exp	1792006000	Expires · Oct 14, 2026, 7:26:40 PM UTC · in 2 hours
iss	https://clerk.utilnest.io	Issuer

What a JWT is

A JSON Web Token is three base64url-encoded parts joined by dots: a header naming the signing algorithm, a payload of claims, and a signature over the first two. Decoding needs no key — anyone holding a token can read it — which is why tokens should never carry secrets, only identifiers and short-lived permissions. The signature is what proves the token was issued by someone holding the key and was not altered.

Registered claims have fixed meanings: iss (issuer), sub (subject), aud (audience), exp (expiry), nbf (not before), iat (issued at) and jti (token id). Anything else is a custom claim defined by the issuer, such as a plan or a region.

Worked example

The RFC 7519 sample token decodes to the header {"typ":"JWT","alg":"HS256"} and the payload {"iss":"joe","exp":1300819380,"http://example.com/is_root":true}. Its exp is 22 March 2011, 18:43 UTC, so the token has long expired.

How this works

Each part is base64url-decoded (RFC 4648 §5, padding restored) and parsed as JSON. Registered claims iat, nbf and exp are interpreted as Unix seconds and compared with your device clock. Optional verification computes an HMAC over header.payload with the Web Crypto API and the secret you type, then compares it with the signature; nothing is transmitted.

Frequently asked

Is it safe to paste my token here?

Decoding runs only in this tab and nothing is sent or logged. Still, treat live tokens as passwords: prefer expired or test tokens on any website.

Why does it say the signature is not verified?

Reading a token never checks the signature. Enter the shared secret to verify HS256, HS384 or HS512 tokens; RS256 and ES256 need a public key, which is on the roadmap.

What does exp mean?

The expiry time in seconds since 1970-01-01 UTC. After it, a correct server rejects the token.

Why can anyone read a JWT?

The payload is only base64url-encoded, not encrypted. Encrypted tokens use JWE (RFC 7516), a different format.

Sources

Reviewed Oct 17, 2026 · test vectors fixtures/dev/jwt-decode/