Developer ToolSecurity Tool

JWT Decoder

Decode JSON Web Token headers and payloads, inspect registered claims, and understand token status.

No tokens storedUTC claim timestampsInstant inspection

no expiry

Encoded Token

132 / 100,000 bytes

Header

Algorithm and token type

{
    "alg": "HS256",
    "typ": "JWT"
}

Payload

Claims and application data

{
    "sub": "1234567890",
    "name": "ToolNest User",
    "iat": 1719792000
}

Issued At

Jul 1, 2024 00:00:00 UTC

Expires At

Not provided

Signature

Present - not verified

Token decoded. No numeric expiry claim was found.

Token Decoded

Technical Specs

Maximum Size: 100 KB
Encoding: Base64URL
Time Zone: UTC
Signature: Displayed, not verified

Security note

Decoding is not verification

Anyone can decode a JWT. Never trust its claims until your backend verifies the permitted algorithm, signature, issuer, audience, and time-based claims using trusted keys.

What is JWT Decoder?

JWT Decoder separates a JSON Web Token into its header, payload, and signature segment, then displays readable claims. Developers and security testers use it to diagnose authentication data, but decoding alone never proves that a token is genuine.

How to use JWT Decoder

1.Paste a token only from a safe test environment.
2.Decode the Base64URL header and payload into readable JSON.
3.Review issuer, audience, subject, expiry, issued-at time, and other claims.
4.Verify the signature separately with the trusted key and expected algorithm.

Key features

✓Header inspection exposes the declared token type and signing algorithm.
✓Claim formatting makes timestamps and nested values easier to review.
✓Expiry checks help identify stale tokens during debugging.
✓Browser-side decoding avoids sending the token to a verification API.

Common use cases

Debug why an API rejects an access token.
Inspect test claims during identity-provider integration.
Confirm an expiry timestamp or expected audience.
Teach JWT structure without writing a decoding script.

Frequently asked questions

Can a JWT be decoded without the secret?

Header and payload segments are encoded, not encrypted, so they can be read without a secret. Signature verification still requires the appropriate trusted key.

Does decoding verify a JWT signature?

No. Treat all displayed claims as untrusted until the signature, algorithm, issuer, audience, and time constraints are verified.

Is it safe to paste a production access token?

Avoid it. Tokens may grant account or API access. Use a revoked or synthetic token and never share the result.

What do exp, iat, and nbf mean?

exp is expiration time, iat is issued-at time, and nbf is the earliest time the token should be accepted; they are commonly Unix timestamps.

Developer newsletter

Stay ahead with new tools

Get practical developer guides, new tools, and workflow improvements without inbox noise.