Developer tool
JWT Decoder
Decode a compact JSON Web Token header and payload in your browser. Inspect common claims, expiry information, and the encoded signature segment for development and troubleshooting, while keeping in mind that decoding is not signature verification.
Parts
3
Characters
177
Signature
Yes
Claims
Token Summary
Not expired
Algorithm
HS256
Type
JWT
Issuer
-
Subject
1234567890
Audience
-
Issued At
May 1, 2024, 2:13:20 AM
Not Before
-
Expires
Jan 1, 2100, 12:00:00 AM
Decoded JSON
Header
{
"alg": "HS256",
"typ": "JWT"
}Decoded JSON
Payload
{
"sub": "1234567890",
"name": "Jane Doe",
"iat": 1714529600,
"exp": 4102444800
}Overview
What Is a JWT Decoder?
A JSON Web Token, or JWT, is a compact, URL-safe representation of claims. A three-part compact JWS token places a Base64URL-encoded header, payload, and signature segment between period characters. A decoder makes the first two JSON values readable for development, debugging, and interoperability work.
This page parses the header and payload locally, displays selected claims, formats numeric time claims using the browser locale, and lets you copy decoded JSON. It does not authenticate the token, decrypt data, fetch keys, or validate an issuer, audience, or application rules.
Format
JWT Parts
Header
A JSON object that can identify a declared type and cryptographic algorithm. This tool displays alg and typ when available.
Payload
A JSON claims set. This tool displays issuer, subject, audience, and common time claims when present.
Signature
The third compact JWS segment. This page reports whether it exists but does not decode or verify it.
Features
JWT Decoder Features
Three-part input
Accepts a token with header, payload, and signature segments separated by periods.
Base64URL decoding
Converts URL-safe Base64 characters and applies padding before decoding the header and payload.
JSON parsing
Parses decoded header and payload text as JSON and reports parser errors.
Claim summary
Displays alg, typ, iss, sub, aud, iat, nbf, and exp when those values are present.
Time summary
Compares numeric exp and nbf claims with the browser clock for a display-only status.
Copy controls
Copies the available formatted header or payload JSON.
Clear and sample
Clears the input or reloads the built-in sample token.
Local operation
Runs decoding in the browser without intentionally uploading the pasted token.
Security
Decoding Is Not Verification
Base64URL decoding makes header and payload content readable; it does not prove who created the token, whether the token changed, or whether it is acceptable for a particular application. A token can be decoded even when it is forged, expired, signed with an unexpected key, or intended for another audience.
Production JWT validation requires an application-specific process that validates the expected algorithm, verifies the signature with a trusted key, and checks applicable claims such as issuer, audience, expiry, and not-before. This tool intentionally does none of those steps.
Claims
Common JWT Claims
iss
Issuer: identifies the principal that issued the token.
sub
Subject: identifies the principal the claims are about.
aud
Audience: identifies intended token recipients; it can be a string or array.
exp
Expiration time: a NumericDate after which the token must not be accepted.
nbf
Not before: a NumericDate before which the token must not be accepted.
iat
Issued at: a NumericDate that identifies when the token was issued.
Workflow
How to Use the JWT Decoder
- Paste a compact token with three dot-separated parts.
- Review the status message if the header or payload cannot be parsed.
- Inspect the claim summary and the decoded JSON panels.
- Copy header or payload JSON when needed for development or debugging.
- Use an appropriate verification process before making security decisions based on a token.
Examples
Common Uses
API debugging
Inspect a token header and payload while troubleshooting a development integration.
Claim review
Check which issuer, subject, audience, and time claims a test token contains.
Documentation
Copy a redacted decoded payload into technical notes or test documentation.
Interoperability
Compare token contents produced by different development environments.
Time-claim inspection
Review a numeric expiry or not-before value in the browser's locale.
Advantages
Benefits
- Makes compact header and payload JSON easier to inspect.
- Shows commonly used claim values without manual Base64URL decoding.
- Formats numeric JWT time claims for quick local review.
- Provides separate copy controls for decoded header and payload JSON.
- Runs directly in a browser-based workflow.
Boundaries
Limitations
- Decoding does not verify authenticity, signature integrity, algorithm suitability, or key trust.
- The tool accepts only the compact three-part form; it does not decrypt five-part JWE tokens.
- Issuer, audience, and application claims are displayed but not validated.
- Expiry and not-before labels depend on numeric claims and the local browser clock.
- Malformed Base64URL data or non-JSON header/payload values cannot be decoded.
Guidance
Tips for Best Results
- Use test or redacted tokens whenever practical; decoded payloads can contain sensitive claims.
- Confirm that a token has exactly three dot-separated parts before decoding.
- Review the declared algorithm but do not treat it as a verified security property.
- Compare time claims with the source system when timing is security-critical.
- Use a production verifier configured with the expected key, algorithm, issuer, and audience.
Avoid
Common Mistakes
- Treating readable payload text as evidence that a token is genuine.
- Assuming an existing signature segment means the signature is valid.
- Using a decoder to make authorization decisions.
- Confusing an encrypted five-part JWE with a three-part signed JWS.
- Assuming an expiry display validates the issuer, audience, or application policy.
Questions
FAQ
What is a JWT Decoder?
A JWT Decoder reads the Base64URL-encoded header and payload sections of a compact three-part JSON Web Token and displays their JSON content.
Does decoding a JWT verify it?
No. This tool only decodes and parses the header and payload. It does not verify the signature, validate a key, or prove that a token is authentic.
What parts of a JWT does this tool decode?
It decodes the first two dot-separated parts as JSON: the header and payload. It shows whether the third signature segment is present, but does not decode or verify it.
Why does a JWT have three parts?
The compact JWS form has a protected header, payload, and signature separated by periods. This implementation accepts that three-part form.
Can this tool decrypt an encrypted JWT?
No. A compact JWE has five parts and requires decryption keys. This tool accepts only three dot-separated parts.
What is Base64URL?
Base64URL is a URL-safe Base64 variant used for compact JWT parts. This implementation converts its URL-safe characters, applies padding when needed, then decodes the header and payload text.
What does the algorithm field mean?
The header may contain an alg value that identifies the declared cryptographic algorithm. Displaying it does not validate that the algorithm or signature is trustworthy.
What are JWT claims?
Claims are name/value pairs in the JSON payload. This tool summarizes alg, typ, iss, sub, aud, iat, nbf, and exp when they are present.
What does the expiry status mean?
When exp and nbf are numeric, the page compares them with the current browser clock to show Expired, Not active, Not expired, or No expiry. This is an unverified display only.
Are exp, nbf, and iat converted to dates?
Yes, when each claim is a number. The tool treats it as seconds since the Unix epoch and formats it using the browser locale.
Why does my JWT show an error?
It may not have exactly three parts, may contain invalid Base64URL data, or its decoded header or payload may not be valid JSON.
Can I copy the decoded header or payload?
Yes. Each decoded JSON panel has a Copy button when valid decoded JSON is available.
Does the decoder support JWKs or JWKS endpoints?
No. It does not request keys, connect to JWKS endpoints, or verify JSON Web Keys.
Does the decoder validate issuer or audience?
No. The tool only displays issuer and audience values when present; it does not compare them with an expected value.
Is my token uploaded to a server?
The decoder runs in your browser and does not intentionally upload the pasted token.
Is the JWT Decoder free?
Yes. This is a free browser-based JWT decoding tool.
Does it work on mobile devices?
Yes. It uses browser text input, buttons, and scrollable decoded JSON panels, so the experience depends on the mobile browser.
More Tools
Related Tools
Terms
Glossary
JWT
A compact, URL-safe claims representation format.
JWS
A JSON Web Signature structure that provides integrity protection or a digital signature.
JWE
A JSON Web Encryption structure that protects content through encryption.
JOSE Header
The header JSON object describing operations applied to a JWT.
Claim
A name/value assertion in a JWT payload.
Base64URL
A URL-safe Base64 encoding used by compact JWT parts.
Signature
The JWS compact segment used in integrity verification.
Issuer
The principal identified by the iss claim.
Audience
The intended recipients identified by the aud claim.
NumericDate
Seconds from 1970-01-01T00:00:00Z UTC, ignoring leap seconds.
Token Validation
The application-specific process of verifying a JWT and required claims.
Token Decoding
Reading encoded token parts without establishing their authenticity.
Sources
References
Security & Cryptography Notice
Security & Educational Disclaimer
This tool decodes JWT header and payload text using its implemented Base64URL and JSON parsing logic. It does not verify signatures, keys, algorithms, issuers, audiences, or application claims, and it does not decrypt JWE tokens. Do not use decoded output alone to make authentication, authorization, or trust decisions.
Calculations and transformations execute locally on your machine with full offline support. Always verify critical results.
View full legal disclaimer