JWT Decoder: Read Header, Payload and Expiry Date

Paste a JWT to view its header and payload as JSON, the iat and exp dates, and whether the token has expired.

Decoding a JWT: header, claims and expiry, without the signature

A JWT (RFC 7519) is three Base64URL segments separated by dots: header, payload and signature. The tool decodes the first two into JSON, converts the iat and exp dates and tells you whether the token has expired; it does not verify the signature, which requires the secret or public key on the server side.

What the decoder does

  1. It splits the token on dots and requires exactly 3 segments; a 5-segment encrypted JWE is rejected.
  2. It turns - and _ back into + and /, pads with = and decodes as UTF-8.
  3. It parses header and payload with JSON.parse and shows the algorithm (alg) and type (typ).
  4. It converts iat and exp (seconds since 1 January 1970) into local dates and compares exp with your device's clock.

Example with the sample token

The header declares alg HS256 and typ JWT. The payload holds sub, name (Jean Dupont), admin, iss and two dates: iat = 1516239022, i.e. 18 January 2018 at 01:30 UTC, and exp = 1781623922, i.e. 16 June 2026 at 15:32 UTC. Checked on 14 October 2026, the token shows Expired, about 120 days ago. The signature is displayed as-is, unchecked.

Security limits

  • A tampered or forged token decodes exactly like a genuine one: successful decoding proves nothing about authenticity.
  • An unsigned token (alg none, empty third segment) is decoded without any warning.
  • The nbf, aud and iss claims are not checked; only exp gets a status.
  • The expiry status depends on your device clock.
  • The payload is encoded, not encrypted: never put passwords or sensitive data in it.

Decoding runs in the browser; the token is not sent anywhere.

Frequently Asked Questions

Does the JWT decoder verify the token signature?

No. It decodes the header and payload and shows the raw signature without checking it. Verifying HS256 needs the secret key, RS256 or ES256 the public key: do it server-side with a JWT library.

How can I tell whether a JWT has expired?

The exp claim holds a date in seconds since 1 January 1970. The sample token has exp = 1781623922, i.e. 16 June 2026 at 15:32 UTC: the tool marks it expired once your device clock passes that time and shows the gap in days, hours and minutes.

Can anyone read a JWT without the key?

Yes, a signed JWT (JWS) is only Base64URL-encoded, so anyone can read its claims. The signature only prevents undetected changes. A 5-segment JWE is encrypted, and the tool rejects it.

Why does the tool say the JWT format is invalid?

The token must contain exactly three dot-separated segments. A truncated copy, spaces, the Bearer prefix or a 5-segment encrypted token trigger the message; a segment that is not Base64URL-encoded JSON causes a decoding error.

Is this tool really free?

Yes, all tools on Kristools are 100% free and accessible without registration.

Is my data protected?

Yes. All processing is performed directly and securely inside your browser. No personal data is sent to our servers.