JWT Decoder

How to Use JWT Decoder

1. Paste your JWT string into the input field of the tool. A JWT typically has three base64url-encoded parts separated by dots.
2. The tool automatically splits the token into header, payload, and signature sections.
3. It decodes the base64url-encoded header and payload using UTF-8 safe decoding, displaying JSON objects for each.
4. View the token claims such as sub (subject), iss (issuer), iat (issued at), and exp (expiration time).
5. Check the expiration status based on the current time and the exp claim if present.

How It Works

JWT Decoder processes tokens client-side using base64url decoding, a variant of base64 encoding that uses URL-safe characters. It applies the TextDecoder API configured for UTF-8 to convert the decoded byte sequences into properly formatted JSON strings, avoiding character corruption. The token's three segments—header, payload, and signature—are separated by periods. The header reveals metadata such as the algorithm (alg) and token type (typ), while the payload contains claims that describe the token's context and validity times. The signature is shown as-is but not verified, since signature verification requires the secret or public key, which the tool does not use to maintain privacy and simplicity. This zero-dependency approach ensures fast, secure decoding entirely in your browser without any network requests.

Example

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwiaXNzIjoiZXhhbXBsZS5jb20iLCJpYXQiOjE2MDAwMDAwMDAsImV4cCI6MTYwMDAwMzYwMH0.dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk

Decoded Output:

Header: {
  "alg": "HS256",
  "typ": "JWT"
}

Payload: {
  "sub": "1234567890",
  "iss": "example.com",
  "iat": 1600000000,
  "exp": 1600003600
}

Signature: dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk

Expiration Status: Expired (if current time is after 1600003600)

When to Use JWT Decoder

• As a developer, inspect JWTs during API development to verify payload claims and header algorithms.
• Security analysts can quickly check token expiration and payload data without exposing secrets.
• Frontend engineers can debug authentication flows by viewing token contents client-side.
• Students learning about JWTs can visually understand token structure and encoding methods.
• SEO specialists managing web tokens for user sessions can verify claims like issuer and expiry.

For related tasks, consider using Base64 Decode to decode arbitrary base64url strings or JSON Formatter to beautify decoded JSON output. You might also use Hash Generator when working with JWT signatures or cryptographic hashes.