JWT Decoder
Decode and inspect JSON Web Tokens (JWT) client-side. View header algorithms, payload claims, expiration timestamps, and active status without transmitting tokens.
What is JWT Decoder?
JWT Decoder is an online inspection tool that splits JSON Web Tokens (RFC 7519) into their constituent parts—Header, Payload, and Signature—and decodes the Base64URL-encoded JSON claims for debugging.
How JWT Decoder Works
A standard JWT consists of three dot-separated Base64URL strings (`header.payload.signature`). The decoder splits the token on `.` delimiters, decodes the header and payload using standard Base64URL decoding, parses the JSON structures, and checks the numeric `exp` claim against current epoch time to determine expiration status.
Key Features
- ✓Automatic expiration status checker (Active vs Expired) with human-readable UTC timestamp
- ✓Clean syntax-highlighted JSON display of Header and Payload claims
- ✓Strips `Bearer ` prefixes automatically
- ✓100% private browser execution—tokens are never transmitted over the internet
Common Use Cases
- •Inspecting OAuth 2.0 / OpenID Connect access tokens and ID tokens
- •Checking user roles, tenant IDs, and scopes embedded in authorization headers
- •Verifying token expiration (`exp`) and issued-at (`iat`) timestamps during authentication debugging
Examples & Sample Data
Inspecting JWT Header and Claims
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyXzQyIiwibmFtZSI6IkFsZXgiLCJyb2xlIjoiYWRtaW4iLCJleHAiOjE5ODcyMzkwMjJ9.4e9g4yWJm7c8VvW24xYQ3iJ7-4pIe8zR9V1s3yWJm7cHeader: { alg: 'HS256', typ: 'JWT' }
Payload: { sub: 'user_42', name: 'Alex', role: 'admin', exp: 1987239022 }Extracts cryptographic algorithm and JSON claims client-side.
Security & Technical Limitations
CRITICAL: Decoding a JWT only parses its visible payload data; it does NOT verify the cryptographic signature. Never trust the claims in an unverified token on your backend server without validating the cryptographic signature against your HMAC secret or RSA/ECDSA public key.
100% Client-Side Privacy Guarantee
Your authentication tokens and secrets never leave your device. All parsing occurs strictly inside local browser memory.
How to Use JWT Decoder
- 1
Paste your JWT string (or Authorization: Bearer token) into the input box.
- 2
Click 'Decode JWT'.
- 3
Review the parsed Header, Payload claims, and Expiration status.