HesapHanem

JWT Decoder

Inspect the contents of a JWT.

How it is calculated

A JSON Web Token is three Base64URL parts separated by dots: header.payload.signature. The tool splits the token at the dots, converts the URL-safe characters (- and _) back to + and /, restores any missing = padding, decodes the first two parts from Base64 and parses them as JSON. It then shows both as formatted JSON and reports the alg field of the header. The tool only reads the token. It does not check the signature, the expiry or the issuer, so a decoded token is not proof that it is genuine. If either part is not valid Base64 or JSON, or the token has fewer than two parts, no result is shown.

Worked example

Paste a token that starts with eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9. The first part decodes to the header, in which the algorithm is HS256:

{ "alg": "HS256", "typ": "JWT" }

The second part decodes to the payload, which holds the claims sub 1234567890, name John Doe and iat 1516239022. The iat value is a Unix timestamp in seconds, here 18 January 2018. The third part is the signature and is not decoded.

Try this example →

Common mistakes

  • Treating a decoded token as verified. Anyone can create a token with any claims; only checking the signature with the key proves it is authentic.
  • Pasting the token with the word Bearer in front, or with quotes or line breaks around it. Paste only the three dot-separated parts.
  • Putting secrets into a JWT because it looks scrambled. The payload is only encoded, so everyone who holds the token can read it.
  • Reading exp, iat and nbf as milliseconds. They are Unix timestamps in seconds, so convert accordingly when checking dates.
  • Pasting a token that has been cut off at the end of the line, which fails Base64 or JSON parsing and returns nothing.

About this calculator

This tool decodes a JSON Web Token (JWT) by base64url-decoding its three dot-separated parts — the header (algorithm and token type), payload (claims like user ID, issuer, and expiry), and signature — and displays the header and payload as readable JSON. It does not verify the signature, so it can't confirm the token is authentic or unmodified.

Backend developers debugging authentication flows, and anyone integrating with an API that uses JWT-based auth, use it to quickly inspect what claims a token carries — such as its expiry (exp) or subject (sub) — without writing decoding code.

Was this helpful?

You can pick up to 3 reactions.

Comments (1)

  • Editorial team

    This tool decodes on our server, so treat a token like a password: paste a test or already expired token, not a live production one. Remember the payload is only encoded, not encrypted, which is why secrets do not belong in it. The time claims such as exp are Unix seconds and are shown raw, so convert them separately. Which claim do you check most often when debugging?

Popular calculators

Loan Calculator

Monthly payment, total interest and full amortization schedule.

Percentage Calculator

Percent change, percent of, and ratio calculations.

Discount Calculator

Calculate final price, savings, and discount amount.

BMI Calculator

Body mass index from height and weight (metric or imperial).

Age Calculator

Compute your exact age in years, months and days from a birth date.

Compound Interest Calculator

Calculate the final amount and interest earned with compounding.

All Calculators