JWT Decoder

What the JWT Decoder does

The JWT Decoder reads a JSON Web Token and shows you what is inside it. A JWT is a compact, dot-separated string with three parts: a header, a payload, and a signature. This tool base64url-decodes the header and payload in your browser and prints them as readable JSON. Nothing is uploaded. Your token stays on the page and is never sent to a server.

How to use it

1. Paste a token into the Token box. You can include the full header.payload.signature string, and a leading Bearer prefix is removed automatically.
2. Press Decode, or leave Live decoding on (the default) to decode as you type.
3. Read the decoded header, the claims table, the algorithm, and the expiry verdict on the right.
4. Use Example to load a sample token, or Clear to reset.

What each section shows

• Algorithm: the alg and typ values from the header, such as HS256 or RS256.
• Expiry: a colour-coded badge (Valid, Expired, or Not yet valid) plus the exact local date and time for the exp claim, a relative time, and a live countdown while the token is valid.
• Header: the decoded header as pretty JSON, with a Copy button.
• Claims: every payload claim in a table with a plain-English description for standard RFC 7519 and OIDC claims (iss, sub, aud, exp, iat, nbf, and more). Time claims such as exp, iat, and nbf are shown as both a Unix timestamp and a human-readable date.
• Signature: the raw signature segment, shown as received. The tool does not verify it, so a decoded payload is not proof the token is authentic.

Checking a token signature (HS256)

Open Verify HS256 signature (optional), enter the HMAC secret the token was signed with, and press Verify. The check runs locally with the browser Web Crypto API and reports whether the signature matches. Verification is supported for HS256 (HMAC) tokens only. RSA and ECDSA public-key verification are not included here.

Worked examples

Example 1: a normal token

Paste a token such as eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkFsaWNlIFRob29scyIsImlhdCI6MTcwMDAwMDAwMCwiZXhwIjoyMDAwMDAwMDAwfQ.signature. The tool shows alg: HS256, a claims table with sub, name, iat, and exp, and an Expiry badge of Valid with a countdown, because exp is set far in the future.

Example 2: an expired or unsigned token

A token whose exp is in the past shows an Expired badge with the date it lapsed. A token with alg: none shows a warning that it carries no signature and can be forged by anyone. Treat such tokens as untrusted.

Limits and edge cases

• The token must have exactly three dot-separated parts. One part, five parts, or a missing segment shows a format error.
• Each of the first two segments must be valid base64url. A corrupted segment shows a decode error rather than fake output.
• Decoding is not encryption. The payload is readable by design, which is why you should never paste production tokens into a server-based tool.
• Unicode claim values such as names or emoji are preserved through UTF-8 decoding.

Why decode locally

Debugging a 401 response or checking what an API actually issued is faster when the token never leaves your browser. This decoder runs entirely in JavaScript, works offline after the page loads, and introduces no external libraries or network calls.