win-j logo
Personal Tech Blog

Developer Utility

JWT Decoder

Paste a JWT token to inspect its Header, Payload, and Signature structure. Check key claims, expiration time, and algorithm information directly in the browser.

Header / Payload Analysis Decode the JWT Header and Payload into readable JSON format.
Claim Summary Quickly check key claims such as exp, iat, iss, aud, and sub.
Browser-side Processing The token you enter is processed only in the browser for decoding and is not sent to a server.

JWT Token Input

Paste the full JWT string to split and inspect the Header, Payload, and Signature sections.

JWT Structure This tool decodes three-part Header.Payload.Signature JWS. Five-part encrypted JWE is not supported.
Important Notice This tool only decodes JWTs. It does not verify signatures or authenticate token validity.

Content decoding only. Signatures, issuers, audiences and permissions are not verified; being before exp does not prove authentication. Only three-part JWS is supported. Input is processed in this browser, up to 200,000 characters.

Parts 0 Token 0 chars alg waiting exp waiting No nbf Waiting for decoding

The downloaded JSON includes the original token and Signature. Copying all results also includes Signature. Review the contents before sharing files or clipboard data.

Key Claim Summary

Shows representative claim values included in the Payload.

Ready

Time checks use the device clock at the decoding time below, without clock-skew tolerance. Results do not update over time; click Decode JWT again to refresh. Checked at:

Subject -
Issuer -
Audience -
Issued At -
Expiration -
Not Before -
Algorithm -

Decoded Result

Inspect the Header, Payload, and Signature sections separately.

Header

{}

Payload

{}

Signature

The signature value will appear here.

JWT Checkpoints

JWT payloads are decodable, but you should not trust an unverified Payload as-is.

Header

Contains token type and signing algorithm information, such as alg and typ.

Payload

Contains claim information such as user identifier, permissions, and expiration time.

Signature

Used to verify that the token has not been tampered with. This page does not verify it.

Help

What is a JWT Decoder?

A JWT Decoder is a developer utility that splits a JSON Web Token into Header, Payload, and Signature sections and displays the Base64URL-encoded Header and Payload as JSON.

It can be used to inspect login token structure, test API authentication, check expiration times, and review claim values.

How to Use

  1. Paste the full JWT token string into the input area.
  2. If auto decode is enabled, the result appears immediately.
  3. Check the Header, Payload, and Signature sections separately.
  4. Use Copy Payload, Copy Full Result, or Download JSON when needed.
Is JWT encrypted?

Header and Payload of the supported three-part JWS are Base64URL encoded. Encrypted JWE also exists, but this tool does not decrypt it.

Does this tool verify the signature?

No. This tool only decodes the Header and Payload. Actual authentication must be performed on the server by verifying the Signature with a secret key or public key.

What are exp, iat, and nbf?

exp, nbf and iat are JSON numbers in Unix seconds. Time at or after exp is expired; time before nbf is not yet active. Numeric strings, null, booleans and values outside the date display range are flagged. Checks use the device clock and do not verify signatures.

Why does JWT decoding fail?

Check for three-part JWS, unpadded Base64URL and UTF-8 JSON objects. Duplicate JSON keys show the last value; numbers have JavaScript precision limits. Compare critical values with the original token.

Can I enter a real production token?

It is safer not to enter real production tokens, administrator tokens, session tokens, or values containing API keys. Use a masked or expired sample token for testing.