JWT Decoder
Decode JSON Web Tokens (JWT) locally to view their header and payload.
Security Warning: Decoding a JWT does not verify its signature. Do not trust the payload unless you verify the signature on your server.
Tokens are decoded locally. They are never sent to a server.
About JWT Decoder
The JWT Decoder lets developers inspect JSON Web Tokens (RFC 7519) safely and locally. A JWT consists of three Base64URL-encoded parts separated by dots: Header (algorithm & token type), Payload (user identity claims, roles, issue time, and expiration), and Signature. Our client-side tool extracts and formats the header and payload claims into readable JSON, allowing rapid inspection of authentication tokens without transmitting credentials to any remote server. Using built-in browser APIs, the decoder instantly parses the token structure, safely decoding the Base64URL format to UTF-8 without requiring server round-trips. This tool goes beyond basic decoding by automatically identifying common time-based claims like exp (expiration time), iat (issued at), and nbf (not before), converting those confusing UNIX timestamps into human-readable local dates and clearly flagging if the token has expired. It is explicitly designed for debugging OAuth 2.0 implementations, troubleshooting microservices authorization, and verifying that API endpoints are issuing tokens with the correct user roles and scopes.
Common Practical Use Cases
Debugging OAuth 2.0 / OpenID Connect authentication flows
Verifying user role and permission scopes assigned in token payloads
Checking whether a token expiration timestamp (exp) has elapsed
Inspecting signing algorithm configurations (RS256 vs HS256)
Auditing custom claims embedded in Single Sign-On (SSO) SAML-to-JWT bridges
How to Use JWT Decoder
- 1Paste your raw JWT string (three-part dot-separated string) into the input area.
- 2The tool splits the token and decodes the Base64URL payload.
- 3Inspect the formatted JSON header and payload claims.
- 4Check the expiration date to verify whether the token is currently active.
Practical Worked Examples
Inspecting Authentication Token Claims
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWUsImV4cCI6MTgwMDAwMDAwMH0.signature
Header: {"alg":"HS256","typ":"JWT"}
Payload: {"sub":"1234567890","name":"John Doe","admin":true,"exp":1800000000}Explanation: Reveals user identifier, administrative status, and expiration epoch.
Supported Formats & Specifications
Accepted Inputs:
- Standard 3-part dot-separated JWT strings (header.payload.signature)
Generated Outputs:
- Decoded Header JSON
- Decoded Payload Claims JSON
- Formatted expiration timestamps
Key Features & Technical Capabilities
- Decodes JWT Header and Payload JSON structures instantly
- Human-readable date parsing for standard claims (exp, iat, nbf)
- Identifies expired tokens with visual status flags
- Client-side memory decoding without server transmission
Under the Hood: Browser Processing Architecture
- Decodes Base64URL strings by replacing "-" with "+" and "_" with "/", followed by UTF-8 byte decoding.
- Automatically parses standard epoch timestamps into localized Intl.DateTimeFormat strings for immediate visual validation.
Browser Limits & Edge Cases
- This tool is an INSPECTOR, not a cryptographic verifier. It does not verify the signature against private secret keys, as keys should never be pasted into a browser.
Common Mistakes to Avoid
- Assuming that because a token can be decoded, it is cryptographically valid (signature verification on backend servers is required for authorization).
Client-Side Code Formatting & Token Privacy
Isolated Local Script SandboxWith JWT Decoder, syntax parsing, encoding/decoding, and cryptographic hashing run locally in your browser's JavaScript engine. API keys, JWT tokens, and sensitive payloads never leave your computer. Standard static web assets and client runtime scripts are delivered securely via CDN over encrypted TLS (HTTPS).
Frequently Asked Questions
Is it safe to decode my JWT here?
Yes. The token is parsed strictly in your browser's local memory. However, never share production tokens containing sensitive private user data.
Why does my JWT signature validation fail on my server if it decodes fine here?
Decoding simply unpacks the Base64URL string into plain JSON. It does not perform cryptographic signature validation. If validation fails on your server, there is likely a mismatch in the signing key, algorithm (such as RS256 vs HS256), or the token has expired.
What do the exp, iat, and nbf claims mean?
These are standard registered claims in the JWT specification. exp stands for Expiration Time, iat for Issued At, and nbf for Not Before. They dictate the exact time window in which the token is considered valid.