JWT Decoder
Decode a JSON Web Token to inspect its header and payload (claims) instantly. Decoding only — the token is never sent anywhere.
Examples
For privacy, tokens are never saved on this device.
Check exp in the timestamp converter · parse OAuth callbacks: Query string parser · Base64url parts: Base64 encoder.
Decode a JSON Web Token
Paste a JWT to inspect its header and payload claims. Standard time claims (iat, nbf, exp) are shown as readable dates with a live expiry status, and the signing algorithm is explained. Decoding only — no verification, and the token never leaves your browser.
FAQ
Does this verify the signature?
No. It only decodes compact token data for inspection. A trusted JWT library must verify the signature, algorithm and key before you use any claim.
Does it show when the token expires?
Yes. It shows exp, nbf and iat in UTC, local time and relative time. The status always says that the signature is unverified, and expired claims are highlighted in red.
Is my token sent anywhere?
No. Decoding happens entirely in your browser — safe for inspecting tokens.
What do the algorithm names (HS256, RS256…) mean?
They describe how a JWS signature is made: HS* uses a shared secret (HMAC), RS*/PS* use RSA key pairs and ES* uses elliptic curves. Missing, unknown and alg=none values are flagged as dangerous.
What is inside a JWT?
A compact JWS has exactly three Base64url parts: header, payload and signature. A five-part token is normally JWE; its payload is encrypted and cannot be decoded without the decryption key.
Last updated: