JWT Decoder

Decode and inspect JSON Web Tokens — header, payload, expiry, and claims.

JWT Decoder

Token

DecodedActive

Header

{
  "alg": "HS256",
  "typ": "JWT"
}

Payload

{
  "sub": "1234567890",
  "name": "Jane Developer",
  "iat": 1516239022,
  "exp": 1999999999
}

Standard claims

Subject

1234567890

Issued (iat)

2018-01-18 01:30:22.000 UTC

Expiry (exp)

2033-05-18 03:33:19.000 UTC

Signature

o2X6b3fVj9tp3xC8g5b2h5Uw9UeCcSlpJgS8CX7z-Wg

Signature is not verified. Verification requires the issuer’s secret or public key.

READY

ALG · HS256TYP · JWT

How to use

Paste a JWT (three dot-separated Base64URL segments). The decoder displays the header, payload and standard claims such as iss, sub, aud, iat, nbf, exp.

Expired tokens are highlighted. The signature is displayed but not verified — verification requires the issuer’s secret or public key.

FAQ

Is my JWT sent anywhere?▾

No. Decoding is 100% client-side.

Why isn’t the signature verified?▾

Verifying a JWT signature requires the issuer’s secret (HMAC) or public key (RSA/EC). Sharing those with a web tool would be insecure.

What algorithms are supported?▾

Any JWT can be decoded regardless of alg. Only decoding is performed — not signing.

Related tools

JSON Formatter

Beautify, minify, validate and inspect JSON with a rich Tree Viewer and Grid Viewer.

Base64

Encode text and files to Base64 or decode Base64 back to text — instantly.

UUID

Generate cryptographically strong UUID v1 / v4 / v7 — single or in bulk.

Hash

MD5, SHA-1, SHA-224, SHA-256, SHA-384, SHA-512 hashes — client-side & safe.