JWT Decoder

Read a token’s header, claims and expiry

calendar_today Last updated: September 17, 2026

Token

Algorithm

HS256

Issued

—

Expires

—

info

This token carries no expiry claim, so whether it is still valid cannot be read from it.

Header

{
  "alg": "HS256",
  "typ": "JWT"
}

Payload

{
  "sub": "1234567890",
  "name": "John Doe",
  "iat": 1516239022
}

warning

The signature is shown but never checked. Verifying it needs the secret or public key, which no web page should ask you for — so treat everything above as claimed by the token, not proven.

lightbulb

Sahel's JWT decoder reads a token's header, claims and expiry without verifying the signature and without asking for your key, entirely inside your browser.

help_outline

How does this tool work?

Paste the token

Three parts separated by dots.

Read the header and claims

With issue and expiry times in readable form.

Remember the limit

The contents are read, not verified — verification needs the key.

Frequently asked questions

Why don't you verify the signature? expand_more

Verification needs the secret or public key, and a web page has no business asking you for one. So we show what the token claims and say plainly that it is a claim, not proof.

Is it safe to paste my token here? expand_more

It is never sent to a server and is decoded in your browser. That said, a live token is a key — it is better not to paste one that is still valid into any tool on the internet.

What does “no expiry claim” mean? expand_more

It means the token has no exp field, so nothing in its contents says when it stops being valid. The server may limit it another way, or may not — the tool reports “unknown” rather than assuming it is fine.

Can I edit a token here? expand_more

No. Changing the claims invalidates the signature, and producing a new one requires the key — which this tool does not have and should not have.

data_object