How to Decode a JWT and Check Expiry

JSON Web Tokens (JWTs) are compact, URL-safe tokens commonly used for authentication and authorization in modern web applications and APIs. When debugging authorization errors or expired sessions, developers often need to inspect the payload claims to see which user ID is represented or when the token expires.

EverythingDeck’s JWT Decoder & Inspector decodes token text in your browser. The token is not sent to EverythingDeck for decoding.

The structure of a JSON Web Token

A standard compact JWT consists of three distinct parts separated by dots (.):

header.payload.signature

Each part is encoded using Base64URL:

1. Header: A JSON object describing the cryptographic algorithm (alg, such as HS256 or RS256) and the token type (typ: "JWT").
2. Payload (Claims): A JSON object containing statements about an entity, typically the authenticated user, and metadata about the token.
3. Signature: A cryptographic hash or digital signature generated by running the encoded header and payload through a signing algorithm with a secret key or private key.

Base64URL encoding vs standard Base64

JWTs use Base64URL rather than standard Base64:

• The standard Base64 characters + and / are replaced with - and _ so the token can safely appear inside URLs and query strings without percent-encoding.
• The trailing = padding characters are omitted to save bandwidth.

To decode a JWT manually in JavaScript or Python, any missing = padding must be restored (making the string length a multiple of 4), and - / _ must be translated back before calling standard base64 decoding functions.

Common JWT payload claims

Standard registered claims include:

• sub (Subject): The principal identifier of the user or system (e.g., "user_12345").
• iss (Issuer): The identity provider that issued the token (e.g., "https://auth.example.com").
• aud (Audience): The intended recipient or API resource.
• iat (Issued At): A Unix timestamp indicating when the token was minted.
• nbf (Not Before): A Unix timestamp before which the token must not be accepted.
• exp (Expiration Time): A Unix timestamp identifying when the token expires.

How to check token expiration

The exp claim is stored as a Unix timestamp in seconds (not milliseconds) since the Unix epoch (January 1, 1970 00:00:00 UTC).

To determine whether a token has expired:

1. Extract the exp integer from the payload (for example, 1761141600).
2. Compare it to the current time in seconds: Math.floor(Date.now() / 1000).
3. If currentTime >= exp, treat the token as expired. The response from an API or gateway depends on that system’s authentication rules.

If you have a raw timestamp and need to inspect human-readable dates across timezones, use the Unix Timestamp Converter.

Decoding versus verifying signatures

There is a critical security difference between decoding a token and verifying a token:

• Decoding merely reads the Base64URL text and parses the JSON. Anyone who possesses a JWT can read its header and payload claims; the information is not encrypted unless you are using JSON Web Encryption (JWE).
• Verifying validates the cryptographic signature with the expected HMAC secret or the issuer’s public key. Successful verification establishes that the signed content has not changed, but the application must still validate the issuer, audience, time claims, algorithm, and other policy requirements.

A client-side inspector can show you what the token claims say, but your backend API server must always perform cryptographic signature verification before granting access to protected resources.

Keep production tokens private

Treat production bearer tokens, authorization headers, and private credentials as sensitive. A remote decoder may receive or retain the text that you submit.

The JWT Decoder & Inspector runs its decoding logic in your browser tab and does not include token text in requests to EverythingDeck. Decoding does not verify the signature or make an untrusted token safe to use.