JWT Decoder
Paste a JWT and I show its decoded header and payload, the signing algorithm and claims (iss, sub, aud, exp, iat, nbf) with readable dates and expiry status. The token never leaves your browser.
Header
—
Payload
—
Registered claims
| Claim | Value | Meaning |
|---|---|---|
| No claims to show yet. | ||
How it works · anatomy of a JWT
1. A JWT has three parts
separated by dots: header.payload.signature. Header and
payload are JSON encoded in Base64URL
(URL-safe variant: +→-,
/→_, no = padding).
2. The header declares the
signing algorithm (alg) and type (typ). The
payload carries the claims: data such as
sub (subject), iss (issuer) or exp
(expiry).
3. The exp, iat
and nbf dates are epoch seconds (Unix). Here
I convert them to readable date and time and compare exp
against the current time to flag the token as
valid or expired.
4. Decoding is not
verifying. Anyone can read the payload; the
signature is what guarantees it was not tampered with. It
is only checked if you paste the HS* secret. Never trust a
token without verifying its signature on the server.
Decoded locally in your browser · no sign-up · the token is never sent to any server.