Skip to main content

JWT Decoder

Decode and inspect JSON Web Tokens — header, payload, signature and timestamp claims.

About this tool

JWT Decoder unpacks a JSON Web Token into its three parts — header, payload, signature — and renders each one human-readable. Paste any JWT you have; nothing is uploaded.

What this tool does

  • Decodes the header (algorithm, type, optional kid) — shown as a quick alg/typ/kid summary plus full JSON.
  • Decodes the payload (also called the “claims”) — every claim is shown both as a sorted key/value table and as pretty-printed JSON.
  • Surfaces exp, nbf, iat timestamps with absolute time + relative “in N min” / “N min ago”.
  • Shows the signature verbatim (it’s base64url-encoded HMAC/RSA bytes; you normally only need to know it’s present).
  • Top-right pill: Active, Expired, or Not yet active, computed from exp / nbf vs. current time.

Why no signature verification?

We deliberately don’t offer to verify HMAC signatures. Doing so means pasting a shared secret — secrets in clipboard history is a bad default. If you need verification, your jwt.io flow or a server-side library is the right place. This tool only decodes.

Token format notes

  • Algorithm none tokens are shown but never validated here.
  • Trailing whitespace, line wraps, and bearer-prefix strings are stripped on input.

Privacy

The token text never leaves your browser tab. Nothing is sent to any server.