Free 100% In-Browser Tool

JWT Decoder: Decode Header, Payload & Signature Online

Decode JSON Web Tokens (JWT) locally in your browser. Inspect headers, payload claims, and expiration timestamps with zero data uploads.

Quick Answer:Paste your encoded JWT (header.payload.signature) into the box. The tool decodes Base64Url components into formatted JSON, checks expiration (exp), and verifies format.

Initializing tool...

Privacy First: 100% Client-Side Processing

Processed in your browser. Files are never uploaded.

How to Use the JWT Decoder: Decode JSON Web Tokens Online (Client-Side)

1Paste your encoded JWT string into the input textarea.
2The tool immediately validates the 3-part dot-separated format.
3Inspect the decoded algorithm header and claims payload in formatted JSON.
4Check token validity: active vs expired, issued-at (iat) date, and expiration (exp) timestamp.

Formula & How It Works

RFC 7519 Base64URL Decoding

JWT = Base64URL(Header) . Base64URL(Payload) . Signature

Decodes URL-safe Base64URL encoded strings into UTF-8 JSON objects and converts UNIX epoch timestamps. Source: IETF RFC 7519 / RFC 7515.

Worked Examples

Standard User Authentication Token

Input: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTYiLCJuYW1lIjoiQWxpY2UiLCJpYXQiOjE1MTYyMzkwMjJ9.signature

Explanation: Decodes user ID and creation timestamp.

Result: Header: { alg: 'HS256', typ: 'JWT' } | Payload: { sub: '123456', name: 'Alice', iat: 1516239022 }

Checking Token Expiration

Input: Payload containing { exp: 1731000000 }

Explanation: Compares current UNIX time with token exp claim.

Result: Expiration status: Token is ACTIVE or EXPIRED based on Date.now()

Decoded Role-Based Claims

Input: Payload with { roles: ['admin', 'billing'] }

Explanation: Enables instant verification of user authorization claims.

Result: Formatted JSON displaying user permissions

Frequently Asked Questions

Is it safe to paste production JWTs into this decoder?▼

Yes! Unlike other online decoders that send your token to an external server, our decoder runs 100% locally in your browser's JavaScript. Nothing is sent over the network.

Does this tool verify the signature of the token?▼

This tool decodes and parses the header and payload. Verifying cryptographic signatures requires your private key or shared secret, which should never be entered into any web tool.

What is a JWT made of?▼

A JWT consists of three parts separated by dots (.): Header (algorithm & token type), Payload (user claims and data), and Signature (cryptographic integrity hash).

Why does the tool show my token is expired?▼

If the 'exp' claim timestamp in the payload is less than the current time (Date.now() / 1000), the token has passed its expiration window.

What is Base64URL encoding?▼

Base64URL is a URL-safe variation of Base64 that replaces '+' with '-' and '/' with '_', and strips trailing '=' padding characters so tokens can be passed safely in URLs and headers.

Can I edit the token payload and re-sign it here?▼

No. Generating new signatures requires your backend application's private signing key.

Quick Reference & Conversion Table

Standard Claim	Full Name	Type	Description
iss	Issuer	String	Identifies the principal that issued the JWT
sub	Subject	String	Identifies the subject of the JWT (e.g. user ID)
aud	Audience	String / Array	Identifies the recipients that the JWT is intended for
exp	Expiration Time	Number (Epoch)	Identifies expiration time on or after which token is invalid
nbf	Not Before	Number (Epoch)	Identifies the time before which the token must not be accepted
iat	Issued At	Number (Epoch)	Identifies the time at which the JWT was issued

⚠️ Common Pitfalls to Avoid

•Pasting tokens with trailing spaces, newlines, or missing third signature segments.
•Confusing token decoding with cryptographic verification (decoding reads claims; signature verification requires the secret key).
•Using online cloud decoders that log confidential production tokens on remote servers.

💡 Practical Real-World Uses

•Debugging OAuth 2.0 and OpenID Connect (OIDC) authentication flows in web applications.
•Verifying user roles, permissions, and scopes inside API authorization headers.
•Checking exact expiration dates of session tokens to diagnose unexpected user logouts.

Last reviewed & updated: 2026-11-07

Free & Open Access

Related Utilities

Explore complementary calculators and converters with instant client-side execution