JWT Decoder

JWT Decoder

A JSON Web Token (JWT) is a compact, URL-safe token format used by nearly every modern authentication system - OAuth access tokens, session cookies for single-page apps, API keys exchanged between microservices, and more. This tool decodes a JWT entirely from its own content: it reads the header and payload, works out the signing algorithm, checks whether the token has expired, and lists the standard claims in a readable table.

What is a JWT?

A JWT is three Base64URL-encoded segments joined by dots:

$$JWT = base64url(header) + "." + base64url(payload) + "." + signature$$

• Header - a small JSON object naming the signing algorithm (alg) and token type (typ), e.g. {"alg":"HS256","typ":"JWT"}
• Payload - a JSON object of claims: application-specific data plus standard registered claims like exp (expiry), iat (issued-at), and sub (subject)
• Signature - computed by signing the header and payload with a secret or private key, so a receiving server can verify the token wasn't tampered with

The header and payload are only encoded, not encrypted - anyone holding a JWT can read its contents, which is exactly what this tool does.

How this tool works

1. Splits the token on . into its three parts and rejects anything that isn't exactly three parts
2. Base64URL-decodes the header and payload segments and parses each as JSON
3. Reads alg and typ from the decoded header
4. If the payload has a numeric exp claim, compares it against the current time to report whether the token is valid or expired, and by how much
5. Pulls out the standard registered claims present in the payload (iss, sub, aud, exp, iat, nbf, jti) into a table, converting Unix timestamps to readable dates

This tool never verifies the signature - doing so would require the signing secret or public key, which this tool never asks for or sees. It only decodes and inspects the parts of the token that are already plain text to anyone who has it.

Worked example

Paste this well-known sample token (also used on jwt.io) into the field above and submit:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

Decoding it gives:

• Header: {"alg":"HS256","typ":"JWT"}
• Payload: {"sub":"1234567890","name":"John Doe","iat":1516239022}
• Status: no expiration claim - the token never expires
• Claims table: sub (Subject) = 1234567890, iat (Issued At) = the timestamp converted to a readable UTC date

Why this matters

Being able to inspect a JWT without pasting it into a random third-party website is useful whenever you're debugging authentication: confirming which algorithm an API actually signs with, checking whether an access token has expired before blaming the client, or verifying that a claim your backend expects (like aud or a custom tenant ID) is actually present in the token you were handed.