Paste any JWT to instantly decode the header, payload, and claims — with expiry status, security warnings, and human-readable timestamps.
jsonwebtoken in Node.js) to verify.Paste a JWT token above to decode it
Format: eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjMifQ.signature
A JSON Web Token (JWT) is a compact, URL-safe method of representing claims between two parties. It is widely used for authentication and authorization in REST APIs, OAuth 2.0, and single-sign-on (SSO) systems.
A JWT has three parts separated by dots (.): the header (encoding algorithm), the payload (claims — user data, expiry, etc.), and the signature (integrity proof). Each part is Base64URL encoded.
The exp claim is a Unix timestamp that specifies when the token expires. The iat (issued at) and nbf (not before) claims are also Unix timestamps. This decoder converts them all to human-readable dates automatically.
jwt.io is the most widely known JWT tool, but it has limitations that matter in real debugging situations. Here is what this decoder does differently:
Security analysis built-in. This decoder automatically flags dangerous configurations — alg:none, missing exp, expired tokens — so you spot problems immediately rather than needing to know what to look for.
Expiry timeline. Instead of just showing the raw exp Unix timestamp number, you see a visual bar showing what percentage of the token's lifetime has passed and exactly how much time remains.
Timestamp auto-conversion. Every Unix timestamp claim (exp, iat, nbf) is automatically converted to your local human-readable date — no need to copy the number into a separate Unix timestamp converter.
No tracking, no ads. CronRead developer tools have no analytics, no ads, and no data collection of any kind. Your tokens stay in your browser.
JWT tokens appear in virtually every modern web and mobile application. The most common uses are:
REST API Authentication — The server issues a JWT after login. The client sends it in the Authorization: Bearer <token> header with every request. The server validates the signature and reads the claims without a database lookup.
OAuth 2.0 & OpenID Connect (OIDC) — Identity providers (Google, Auth0, Okta, Keycloak) issue JWTs as ID tokens and access tokens. The sub claim is the user ID, email is the verified email, and aud is your application's client ID.
Microservices — A gateway issues a JWT after authenticating a request. Downstream services verify the token's signature using a shared public key — no inter-service auth call needed.
Debugging tip: If you see a JWT in a cookie, Authorization header, or URL parameter and want to quickly understand what it contains — paste it here. Common fields to check: exp (has it expired?), sub (which user?), scope (what permissions?), aud (is your service the intended audience?).
| Algorithm | Type | Key | Best For |
|---|---|---|---|
| HS256 | Symmetric HMAC | Shared secret | Single-service apps where one party signs and verifies |
| HS384 / HS512 | Symmetric HMAC | Shared secret | Same as HS256 but with stronger hash (384 or 512-bit) |
| RS256 | Asymmetric RSA | Private key signs, public key verifies | Distributed systems, third-party token verification |
| RS384 / RS512 | Asymmetric RSA | Private / public key pair | Higher-security variants of RS256 |
| ES256 | Asymmetric ECDSA | EC private / public key | Smaller tokens than RSA, mobile & IoT use cases |
| PS256 | RSA-PSS | Private / public key pair | FIPS-compliant environments requiring RSA-PSS |
| none | No signature | None | ⚠️ Never use in production — critical security vulnerability |
jsonwebtoken (Node.js), PyJWT (Python), or your backend framework to verify signatures.none algorithm means the token has no signature. Some vulnerable JWT libraries historically accepted these tokens as valid, allowing attackers to forge tokens. Always reject tokens with alg: none in production.| Tool | What you'll find |
|---|---|
| Unix Timestamp Converter | Convert the JWT exp/iat/nbf Unix timestamps to human-readable dates |
| YAML ↔ JSON Converter | Convert Kubernetes, GitHub Actions and Docker configs between YAML and JSON |
| Base64 Encoder / Decoder | Encode or decode Base64 strings and files |
| Cron Expression Generator | Build cron expressions for your scheduled jobs |