● Security & Web
JWT Decoder
Decode JSON Web Tokens to inspect Header, Payload claims, and expiration.
Processed locally. Your input stays in this browser.
Zero Data SentSecurity Disclaimer
⚠️ Security Disclaimer: Decoding a JWT reveals its payload contents but DOES NOT verify its signature. Anyone can issue a forged JWT with arbitrary payload. Never trust unverified JWT claims for security decisions.
1 line•177 chars•177 B
Ctrl/Cmd+Enter run
Algorithm: HS256Type: JWT
TOKEN ACTIVE
JOSE Header
JSON Tree ExplorerMax Depth 15 • Virtual Windowing Active
{
alg:"HS256",
typ:"JWT"
}
Payload Claims
JSON Tree ExplorerMax Depth 15 • Virtual Windowing Active
{
sub:"1234567890",
name:"John Doe",
iat:1516239022,
exp:2000000000
}
Raw Signature Component:
SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
How It Works
- 1.Paste a JSON Web Token (encoded as header.payload.signature) into the editor.
- 2.The tool decodes Base64URL header and payload parts locally in your browser.
- 3.Inspect claim fields (subject, issuer, issued at, expiration time).
Common Use Cases
- •Debugging OAuth2 / OpenID Connect access tokens and ID tokens.
- •Inspecting custom claim attributes during backend API development.
Frequently Asked Questions
Does decoding a JWT verify its signature?
NO. Decoding extracts the payload for inspection but DOES NOT verify the secret key or public key signature.
Is my JWT sent to a remote server?
Never. Decoding is done 100% locally in your browser.