JWT Reader
Decode the header and payload and show dates. Reading a token does not prove its signature.
Paste a token with three parts separated by dots. A leading "Bearer " is fine. It stays in this page.
Try:
Your result
Paste a token to read its header, payload, and dates.
How to use it
- Paste the three-part token.
- Read the header and the payload.
- Treat the signature line as unchecked.
Examples
- Ada and an expiryeyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiJhZGEiLCJleHAiOjE3NjcyMjU2MDB9.e30 header: {"alg":"none","typ":"JWT"} payload: {"sub":"ada","exp":1767225600} exp: 2026-01-01T00:00:00.000Z signature: not checked
- Grace without a dateeyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiJncmFjZSIsIm5hbWUiOiJHcmFjZSJ9.e30 header: {"alg":"none","typ":"JWT"} payload: {"sub":"grace","name":"Grace"} signature: not checked
- A numeric iatthe same header with iat 1767225600 header: {"alg":"none","typ":"JWT"} payload: {"iat":1767225600} iat: 2026-01-01T00:00:00.000Z signature: not checked
Tool details and privacy
Paste a token with three parts. The page shows the header, the payload, and iat, nbf, or exp as a UTC time when the value is a number. The signature is left unread.
A readable payload is not a valid login. The page separates those two facts.
Options
- Dates are shown only for numeric iat, nbf, and exp.
- The third part can be any non-empty text.
Limits
- The signature is not checked. A decoded token is not proof that it was signed.
- Two parts, or a part that is not JSON, are refused.
- Nothing is sent to a server.
Privacy
What you type stays in your browser. Nothing is uploaded or saved on the server.
Questions
Does reading the token prove the signature?
No.
Is the token sent anywhere?
No.
What does a two-part token do?
It is refused.
Are exp values converted?
Numeric exp, iat, and nbf become UTC times.