JWT Decoder

A JSON Web Token (JWT) is a compact, URL-safe token used to transmit claims between parties — most commonly for authentication and authorization. It has three base64url-encoded segments separated by dots: the header (algorithm and token type), the payload (the claims), and the signature. This decoder splits the token into those three segments, decodes the header and payload into readable JSON, highlights the syntax, lists the registered claims with human-readable timestamps, and reports the algorithm and signature size.

No — everything runs 100% locally in your browser. The token is decoded with plain JavaScript in your tab; nothing is ever sent to a server. That makes it safe to inspect tokens from production systems, provided you treat them with the same care you would give a password — a JWT payload can contain sensitive claims, so still avoid pasting tokens from critical accounts into any third-party page.

Yes. The header and payload of a JWS token are not encrypted — they are only base64url-encoded, which is reversible without any key. Anyone can read them, which is why you should never put sensitive data in a JWT payload. The signature is the part that requires the secret to verify; the decoder still shows its byte length so you can confirm it is present.

The exp (expiration time), nbf (not before), and iat (issued at) claims are Unix timestamps. The decoder converts them to your local date and time and shows a relative label such as "expires in 2 hours" or "expired 5 days ago". A token with an exp in the past must be rejected by the server; a token with an nbf in the future is not yet valid. The status pill next to each timestamp claim summarizes this at a glance.

Yes, for symmetric HMAC tokens (HS256, HS384, HS512) when you supply the shared secret. Verification runs entirely in your browser using the native Web Crypto API — the secret never leaves your device. Asymmetric tokens (RS256, ES256, etc.) cannot be verified without the issuer's public key, so the tool reports that clearly instead of guessing. Decoding the header and payload never requires the secret at all.

JWS (JSON Web Signature) is the common form: header.payload.signature where the payload is readable but signed, so tampering is detectable. JWE (JSON Web Encryption) has five segments and the payload is actually encrypted, so it cannot be read without the decryption key. The decoder detects a five-segment token automatically and shows the JWE header while explaining that the payload requires a key.

The most common causes are: (1) the token is not actually a JWT (for example, an opaque session ID or a different format), (2) it has the wrong number of dot-separated segments, (3) a segment contains characters outside the base64url alphabet or is missing padding, or (4) the header or payload decodes to something that is not a JSON object. The decoder reports exactly which segment failed so you can diagnose the token.

Yes — completely free, with no registration, no sign-up, no premium tier, and no data collection. Decoding, claim analysis, and HMAC verification all run locally on your device. Pair it with our JSON formatter, hash generator, and password tools for a complete developer toolkit.