JWT Decoder & Inspector
Decode and inspect JSON Web Tokens locally. See the header, payload, registered claims and expiry status. Signatures are not verified.
How a JWT works
A JSON Web Token has three dot-separated Base64URL segments:
- Header — the algorithm and key type (
alg,typ) - Payload — the claims: who the user is, permissions, and timestamps
- Signature — an HMAC (or asymmetric) signature over the first two segments
The first two segments are merely Base64URL-encoded, so anyone holding a token can read its contents. That is expected — JWTs are meant to be readable, not secret.
Registered claims
| Claim | Meaning |
|---|---|
iss | Issuer — who created the token |
sub | Subject — who the token is about |
aud | Audience — who the token is intended for |
exp | Expiry — when it stops being valid |
nbf | Not before — when it starts being valid |
iat | Issued at — when it was created |
jti | JWT ID — unique identifier for the token |
Important security note
Decoding is not verifying. This tool shows you what a token contains, but it cannot confirm the signature is authentic. Anyone can hand-craft a token with any payload and it will decode fine. Only your server can verify the signature and decide whether to trust the claims.
If you are investigating a suspicious token, never send it to a third-party service — it may contain session identifiers. Decode it locally, as you are doing here.
Related
Need to encode the raw parts? Use the Base64 encoder.
Frequently asked questions
Is my token uploaded anywhere?
No. The token is decoded in your browser and never sent to a server. This matters — a live token is often a session credential.
Can this verify the signature?
No. Decoding shows you the contents; only your server, holding the signing key, can verify authenticity. A forged token will decode perfectly.
Why does my token show as expired?
The exp claim is a Unix timestamp in seconds. The tool compares it against the current time, so an expired token is reported with the exact expiry date.
What do the registered claims mean?
iss is the issuer, sub the subject, aud the audience, exp the expiry, nbf the not-before time, iat the issued-at time and jti a unique token ID.
Is it safe to paste a production token?
Because decoding is entirely local, it is safe from a data-handling perspective. Still, treat tokens as secrets and rotate anything you paste into a shared environment.