JWT Decoder
Decode JWT structure, claims and expiry
Input JWT
Decoded Result
Standard Claims
| Claim | Value | Description |
|---|
How to Use
A JSON Web Token (JWT) is the login credential you meet in almost every modern web project: three Base64URL strings - header, payload and signature - joined by dots. The first two parts are encoded, not encrypted, so anyone holding the token can read them. That is exactly why putting user IDs, roles or expiry times inside a JWT deserves care. This tool replaces the manual base64 juggling: paste a token and get the formatted header and payload JSON instantly.
Beyond the raw JSON, common claims such as alg, typ, iss, sub, aud and jti are arranged into a name / value / description table, while the time-based claims exp, iat and nbf are converted into your local timezone and checked against the system clock, showing whether the token is still valid and how long it will live. Note that this tool never verifies the signature - the third segment is shown with its length only, because real verification requires the secret key and belongs on the server. Everything is decoded locally in your browser; the token never leaves your machine.
FAQ
Does this tool verify the JWT signature?
No. Signature verification requires the secret key or key pair held by your server and cannot be done safely in a browser tool. This page only performs Base64URL decoding and shows the length of the signature segment. A token being readable never means it is trustworthy - always verify signatures on your server.
Which tokens are supported? Can it decode encrypted JWE?
Standard three-part JWS tokens (Header.Payload.Signature) are fully supported. JWE tokens, which usually have five segments, carry ciphertext that cannot be opened without the key and are not supported. The payload must also be UTF-8 encoded JSON, otherwise decoding fails.
How is the expiry status decided, and why may it differ from my server?
The tool reads the exp claim (a Unix timestamp in seconds) from the payload and compares it with your computer clock, then shows the remaining or elapsed time. If your local clock is off, your timezone differs, or your server applies a leeway, results may differ. Treat it as a debugging hint only; the server verdict is final.