🪪

JWT Decoder

Decode and inspect JSON Web Tokens (JWT) client-side. View header algorithms, payload claims, expiration timestamps, and active status without transmitting tokens.

Decoded Header and Payload claims will appear here...

What is JWT Decoder?

JWT Decoder is an online inspection tool that splits JSON Web Tokens (RFC 7519) into their constituent parts—Header, Payload, and Signature—and decodes the Base64URL-encoded JSON claims for debugging.

How JWT Decoder Works

A standard JWT consists of three dot-separated Base64URL strings (`header.payload.signature`). The decoder splits the token on `.` delimiters, decodes the header and payload using standard Base64URL decoding, parses the JSON structures, and checks the numeric `exp` claim against current epoch time to determine expiration status.

Key Features

  • ✓Automatic expiration status checker (Active vs Expired) with human-readable UTC timestamp
  • ✓Clean syntax-highlighted JSON display of Header and Payload claims
  • ✓Strips `Bearer ` prefixes automatically
  • ✓100% private browser execution—tokens are never transmitted over the internet

Common Use Cases

  • •Inspecting OAuth 2.0 / OpenID Connect access tokens and ID tokens
  • •Checking user roles, tenant IDs, and scopes embedded in authorization headers
  • •Verifying token expiration (`exp`) and issued-at (`iat`) timestamps during authentication debugging

Examples & Sample Data

Inspecting JWT Header and Claims

Input
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyXzQyIiwibmFtZSI6IkFsZXgiLCJyb2xlIjoiYWRtaW4iLCJleHAiOjE5ODcyMzkwMjJ9.4e9g4yWJm7c8VvW24xYQ3iJ7-4pIe8zR9V1s3yWJm7c
Output
Header: { alg: 'HS256', typ: 'JWT' }
Payload: { sub: 'user_42', name: 'Alex', role: 'admin', exp: 1987239022 }

Extracts cryptographic algorithm and JSON claims client-side.

⚠️

Security & Technical Limitations

CRITICAL: Decoding a JWT only parses its visible payload data; it does NOT verify the cryptographic signature. Never trust the claims in an unverified token on your backend server without validating the cryptographic signature against your HMAC secret or RSA/ECDSA public key.

🔒

100% Client-Side Privacy Guarantee

Your authentication tokens and secrets never leave your device. All parsing occurs strictly inside local browser memory.

How to Use JWT Decoder

  1. 1

    Paste your JWT string (or Authorization: Bearer token) into the input box.

  2. 2

    Click 'Decode JWT'.

  3. 3

    Review the parsed Header, Payload claims, and Expiration status.

Frequently Asked Questions

Related Tools