JWT decoder

JWT Decoder

Paste a JWT token to decode its header and payload in the current browser, then inspect common claims, time fields, and expiration status.

Frontend onlyUnicode JSONNo signature check

JWT token

The token is processed only in this browser. It is not uploaded or saved.

Ready for input

Header JSON

Decoded and formatted JSON will appear here.

Payload JSON

Decoded and formatted JSON will appear here.

Common claims

alg

The signing algorithm declared in the header, such as HS256, RS256, or none.

Not present

typ

The token type declared in the header. JWT is the common value.

Not present

iss

Issuer, the service or principal that issued the token.

Not present

sub

Subject, the user, account, or business principal the token is about.

Not present

aud

Audience, the intended recipient for the token. It may be a string or an array.

Not present

iat

Issued At, usually a Unix seconds timestamp for when the token was issued.

Not present

nbf

Not Before, the time before which the token should not be accepted.

Not present

exp

Expiration Time, used to determine whether the token has expired.

Not present

Decode only, no signature verification

This tool does not verify signature authenticity, issuer trust, or whether the token was tampered with. Treat the result as local readability analysis only.

Local processing

Decoding, JSON formatting, claim descriptions, and copying use browser APIs only. The page does not call a backend, upload tokens, save history, or write to browser storage.

Built for local inspection

Header / Payload

Format header and payload JSON separately so alg, typ, and business claims are easy to inspect.

Time fields

Convert iat, nbf, and exp into readable local times and show whether the token is expired.

Clear errors

Show specific messages for JWT structure, Base64URL, and JSON parsing problems.