JWT Decoder

Decode a JSON Web Token and inspect its header and claims.

JWT Decoder

Developer tool running locally in browser

Input

Ad Space (auto) — Configurable via NEXT_PUBLIC_ADSENSE_CLIENT

What does JWT Decoder do?

Paste a JWT to see its header and payload decoded as formatted JSON, with the standard claims interpreted — issuer, audience, subject, and the timestamps converted into readable dates with an expiry check.

How to Use JWT Decoder

1
Paste the tokenThe three dot-separated segments.
2
Read the decoded partsHeader, payload and claim interpretation.
3
Check the expiryShown as a status with the remaining time.

Key Features

Header and payload decoded and pretty-printed
Standard claims interpreted: iss, sub, aud, exp, nbf, iat and jti
Timestamps converted to readable dates with time remaining
Expiry status shown prominently
Algorithm from the header displayed, with a warning for "none"
Signature shown but explicitly not verified

Frequently Asked Questions

Does this verify the signature?

No. Verification requires your secret or public key, and pasting a signing secret into any web page is a bad idea. Verify signatures on your server, where the key belongs.

Is a JWT encrypted?

A standard signed JWT is not. The header and payload are Base64URL-encoded, which anyone can decode. The signature proves the token was not altered — it does not hide the contents. Never put secrets in a JWT payload.

What do the claim abbreviations mean?

iss is the issuer, sub the subject, aud the intended audience, exp the expiry time, nbf the earliest valid time, iat when it was issued and jti a unique token ID. All are Unix timestamps in seconds.

Is it safe to paste a token here?

Decoding happens entirely in your browser and nothing is transmitted. Even so, a live access token is a credential — prefer an expired or test token, and rotate anything you paste anywhere.

100% Data Privacy

The token is decoded in your browser and never transmitted. Treat any live token as a credential regardless — rotate it if it has been pasted into any web page.