Skip to main content
SiteIndex
DeveloperReady to use

JWT Decoder

Decode readable JWT headers and payloads locally without verifying signatures.

Guide

Interactive workspace

No account required
JWT Decoder

Decoded locally. This tool does not verify signatures, issuer, audience, not-before claims, revocation, or token trust. Never use a decoder result as an authentication decision.

How to use it

  1. Paste a synthetic or redacted three-part JWT; avoid sharing production credentials.
  2. Select Decode token to inspect the JSON objects and any exp claim.
  3. Treat the result only as readable data, not evidence that a token is authentic or authorized.
What is JWT Decoder?

Decode readable JWT headers and payloads locally without verifying signatures.

How it works

Splits a three-part readable token, decodes its unpadded Base64URL header and payload as JSON objects, and displays them locally. A finite numeric exp claim is compared to the device clock, including epoch zero. Expiry status is explicitly unverified; the signature is not checked.

Example input and expected output

Input

eyJhbGciOiJub25lIn0.eyJleHAiOjB9.

Expected output

Header: {"alg":"none"}
Payload: {"exp":0}
Expiry: 1970-01-01T00:00:00.000Z - expired claim, signature not verified
Common uses
  • Inspect claim names in a synthetic development token.
  • Check whether an exp value uses numeric Unix seconds.
  • Identify an unsigned alg none token without trusting its contents.
Limitations
  • Does not verify signatures, issuer, audience, not-before claims, revocation, or authorization. Never use the displayed status as an authentication decision.
  • Only readable three-part JSON-object tokens are supported, not encrypted five-part JWE. Header and payload must use unpadded Base64URL.
  • Input is capped at 100,000 characters. Expiry comparisons depend on the device clock and JavaScript Date range.
Frequently asked questions
Does Not expired mean a token is valid?
No. It only compares the unverified exp claim to the device clock. Anyone can construct readable claims.
Why does exp 0 show as expired?
Zero is a real Unix timestamp: January 1, 1970 at midnight UTC. It must not be treated as a missing claim.
Can this inspect encrypted JWTs?
No. Encrypted five-part JWE is not supported; this tool reads three-part tokens with JSON-object header and payload.
What does alg none mean?
It declares no cryptographic signature. The UI warns that the token must not be trusted.

Related tools

Hash Generator
Create MD5, SHA-1, SHA-256, SHA-384, or SHA-512 checksums locally in your browser, and compare text digests with a published value.
Base64
Encode and decode UTF-8 text directly in your browser.
URL Parser
Break down a URL into protocol, host, path, query parameters, hash, and other useful components.
JSON Formatter
Validate, format, minify, copy, and download JSON with a quick browser-based parser.
JWT Signer
Sign JSON claims as a JWT with HMAC or an RS256 private key using browser cryptography.