JWT Decoder
Paste a JWT and I show its decoded header and payload, the signing algorithm and claims (iss, sub, aud, exp, iat, nbf) with readable dates and expiry status. The token never leaves your browser.
Header
—
Payload
—
Registered claims
| Claim | Value | Meaning |
|---|---|---|
| No claims to show yet. | ||
How it works · anatomy of a JWT
1. A JWT has three parts
separated by dots: header.payload.signature. Header and
payload are JSON encoded in Base64URL
(URL-safe variant: +→-,
/→_, no = padding).
2. The header declares the
signing algorithm (alg) and type (typ). The
payload carries the claims: data such as
sub (subject), iss (issuer) or exp
(expiry).
3. The exp, iat
and nbf dates are epoch seconds (Unix). Here
I convert them to readable date and time and compare exp
against the current time to flag the token as
valid or expired.
4. Decoding is not
verifying. Anyone can read the payload; the
signature is what guarantees it was not tampered with. It
is only checked if you paste the HS* secret. Never trust a
token without verifying its signature on the server.
Decoded locally in your browser · no sign-up · the token is never sent to any server.
How it works
The decoder takes a JSON Web Token (RFC 7519) with its three-part structure header.payload.signature and locally decodes the first two, which are JSON encoded in Base64URL (the URL-safe Base64 variant: +→-, /→_, no = padding). It shows the signing algorithm (alg) and type (typ) from the header, the pretty-printed payload, and the registered claims (iss, sub, aud, exp, iat, nbf) with their epoch timestamps converted to readable dates.
It also compares exp against the current time to mark the token as valid or expired. Important: decoding is not verifying; anyone can read a JWT payload. If the token is signed with HMAC (HS256/384/512) you can paste the secret and the tool checks the signature in your browser using Web Crypto; asymmetric signatures (RS*/ES*) are not verified here and must always be validated server-side.
Example: reading the classic test token
- Paste a token such as
eyJhbGciOiJIUzI1NiIs…(the Load sample button provides one). - The decoded header shows
{ alg: HS256, typ: JWT }and the payload{ sub: 1234567890, name: John Doe, iat: 1516239022 }. - The
iat(issued at) claim is translated from epoch 1516239022 to January 18, 2018 (UTC); since there is noexp, no expiration is flagged. - If you paste the correct HS256 secret, the signature is validated locally and the status changes to signature verified.