JWT Decoder
Inspect a JSON Web Token’s header, payload and expiry without sending it anywhere.
● Runs 100% in your browser — nothing you type leaves this page.
🔒 The token is decoded in your browser and never sent anywhere. Still, treat real tokens like passwords.
How to use it
Paste a token — the eyJ… string, with or without Bearer in front. You see:
- the header (the algorithm,
alg, and the key ID,kid); - the payload (the claims: who the user is, roles, scopes…);
- the times —
iat(issued at),nbf(not before),exp(expires) — as dates, and whether the token is expired right now.
The token is decoded in your browser and never sent anywhere.
Warning
Decoding is not verifying. A JWT’s header and payload are only Base64URL-encoded, so anyone can read them — and anyone can create a token with any content. Whether a token is genuine depends on its signature, which only the server with the key can check. Never trust a token’s content in your app without verifying it with a proper JWT library.
Kubernetes service account tokens are JWTs too: exp and sub tell you when one stops working and which account it belongs to, which helps with kubectl’s “Unauthorized”.
Common problems
| Symptom | Look at |
|---|---|
401 Unauthorized / token expired |
exp — is it in the past? Check the clocks too: servers with a wrong time reject valid tokens |
| Token rejected right after login | nbf / iat in the future — the clocks of the two servers differ |
invalid audience / invalid issuer |
aud and iss must match what the API expects |
invalid signature |
Wrong key, or the token was modified. A different kid in the header points to key rotation |
alg: none |
A token with no signature — an API must never accept it |
FAQ
Can it read encrypted tokens?
No. An encrypted JWT (JWE) has five parts instead of three, and its content can only be read with the key. The tool tells you when you paste one.
Is it safe to paste a real token?
It never leaves your browser here. But a valid token is like a password until it expires: don’t paste production tokens into tools you don’t trust, and don’t share screenshots of them.
My API says “jwt expired” or “invalid signature”. What now?
Decode the token here to read its dates and algorithm, then follow JWT “jwt expired” and “invalid signature”.
Microsoft sign-in fails with an AADSTS code
See AADSTS errors. You can decode the token you get here, to check its audience and tenant.
Articles
Learn more
Azure and Entra ID "AADSTS" errors: what the most common codes mean, and how to fix them
Fix Microsoft Entra ID AADSTS sign-in errors: 50076 (MFA), 700016 (app not found), 7000215 (bad secret), 50011 (reply URL), 65001 (consent), 53003 (Conditional Access).
Intermediate · 5 min read
JWT "jwt expired" and "invalid signature": how to find out what is wrong with a token
Fix JWT "jwt expired" and "invalid signature": read the exp claim, check clock differences, the secret, HS256 vs RS256 and rotated keys, without turning verification off.
Intermediate · 5 min read