---
title: "How to decode a JWT and read its claims | ToolSugar"
description: "Decode a JSON Web Token to read its header, payload and expiry date, and learn what the decoder can and cannot tell you about the signature."
canonical: https://toolsugar.com/blog/how-to-decode-a-jwt
image: https://toolsugar.com/og.png
---

# How to decode a JWT and check when it expires

Updated 2026-11-09

To decode a JWT, split it at the dots and Base64URL-decode the first two parts into JSON. JWT Decoder does that for you in your browser and never sends the token anywhere. Paste the token, read the header and payload, and see whether it has expired. It decodes only. It cannot prove the token is genuine.

[Open JWT Decoder](https://toolsugar.com/tools/jwt-decoder)

## Decode a JWT in four steps

Copy the whole token, with all three parts and both dots. A missing part is the most common reason a paste fails.

1. Paste the token into the JSON Web Token box.
2. Read the Expired or Not expired line and the iat, exp and nbf dates.
3. Review the Header and Payload JSON, and press Copy on either one.
4. Remember that the signature is shown but not verified.

## The three parts of a token

A JWT is header.payload.signature. The header names the algorithm, for example HS256 or RS256. The payload holds the claims, such as the user ID in sub and the audience in aud. Both are JSON encoded as Base64URL, which is why anyone can read them. That also means you should keep secrets out of the payload. A password, a card number or a private note placed in a claim is visible to anyone who holds the token, including a browser extension or a log file that records request headers.

The signature is a hash or a digital signature over the first two parts. Only the server with the key can check it.

## Read the time claims

Three claims hold times as Unix seconds. iat is when the token was issued, exp is when it stops being valid, and nbf is the earliest moment it counts. The tool shows each one as a date, in UTC and in your local time.

If an API returns 401 and the token is marked expired, request a new one. If nbf is in the future, check the clock on the machine that issued the token.

## Decoding is not verifying

Anyone can write a payload and Base64URL-encode it. Only a signature check with the right key shows that the server issued it. This tool does not do that check, so treat its output as a readable view and nothing more.

Do not trust a claim such as an admin role because it appears in a decoded token. Your server must verify the signature before it acts on any claim.

## Questions

### Can I decode a JWT without the secret key?

Yes. The header and payload are only encoded, not encrypted, so no key is needed to read them. The key is needed only to verify the signature.

### What does the alg value in the header mean?

It names the algorithm used to sign the token. HS256 uses a shared secret, and RS256 uses a private and public key pair.

### Why does my token fail to decode?

Check that you copied all three parts with their dots and that no spaces or quotes came along. A token with an encrypted payload will not decode into readable JSON.

[Open JWT Decoder](https://toolsugar.com/tools/jwt-decoder)

## Related guides

- [How to encode and decode Base64 online](https://toolsugar.com/blog/how-to-encode-and-decode-base64)
- [How to format JSON online](https://toolsugar.com/blog/how-to-format-json)
- [How to generate UUIDs in bulk (v4 and v7)](https://toolsugar.com/blog/how-to-generate-a-uuid)

## Comparisons

- [jwt.io alternative](https://toolsugar.com/alternatives/jwt-io-alternative)