JWT Decoder
Decode readable JWT headers, payloads, and common NumericDate claims privately in your browser without verifying the signature.
JWT input
Decoded output
No decoded output yet. Enter a JWT and select Decode JWT.
How it works
What is a JWT?
A JSON Web Token is a compact way to carry claims between systems. A readable signed-style compact JWT normally has a header, payload, and signature separated by dots. JWT is a family of formats: tokens can also be encrypted or explicitly unsecured.
Header, payload, and signature structure
The header contains token-supplied declarations such as alg, typ, and kid. The payload contains claims such as sub, aud, exp, iat, and nbf. The third segment carries signature bytes for signed tokens. Every decoded field remains untrusted because this tool does not check those bytes against a key.
How Base64url decoding works
Base64url represents bytes using letters, numbers, hyphens, and underscores, with optional valid padding. The first two segments are decoded as strict UTF-8 and then parsed as JSON objects. Encoding makes data compact and URL-safe; it does not encrypt it.
exp, iat, and nbf timestamps
JWT NumericDate claims count seconds from the Unix epoch, including optional fractional seconds. The decoder shows the raw claim and its UTC date when representable. It does not coerce strings, guess millisecond values, compare claims to the clock, or declare a token valid.
Why decoding is not verification
Anyone can construct or modify encoded header and payload data. Only cryptographic verification using an appropriate trusted key and policy can test a signature, issuer, audience, algorithm, and other application requirements. None of those checks happen here.
Supported and unsupported formats
This release supports three-segment compact tokens whose first two segments are Base64url-encoded UTF-8 JSON objects. An empty third segment is accepted only when the header declares alg: "none", and a warning identifies that token as unsecured. Five-segment JWE, opaque bearer tokens, detached or non-JSON payloads, b64: false unencoded payloads, and other compact extensions are rejected.
Browser-local privacy
Decoding happens on demand in browser memory. The tool does not use a server action, browser storage, query parameters, remote validation, issuer discovery, analytics submission, or console logging for token content. Clear removes the current in-memory input and output.
Example
Harmless illustrative token with an unverified signature segment:
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJkZW1vLXVzZXIiLCJpYXQiOjE3MDAwMDAwMDAsImV4cCI6MTcwMDAwMzYwMH0.aWxsdXN0cmF0aXZlLXVudmVyaWZpZWQtc2lnbmF0dXJlDecoded header
{
"alg": "HS256",
"typ": "JWT"
}Decoded payload
{
"sub": "demo-user",
"iat": 1700000000,
"exp": 1700003600
}The third segment is illustrative data, not a working or verified signature. The iat value represents 2023-11-14T22:13:20.000Z, and the exp value represents 2023-11-14T23:13:20.000Z.
Frequently asked questions
What is a JWT?
A JSON Web Token is a compact format for carrying JSON claims. JWTs may be signed, encrypted, or unsecured depending on their serialization and declared algorithm. This tool handles readable three-segment compact tokens only.
Can I decode a JWT without its secret key?
Yes. The header and payload of a typical signed compact JWT are Base64url encoded, not encrypted. A key is needed to verify a cryptographic signature, which this decoder deliberately does not do.
Does decoding verify the JWT signature?
No. Decoding only makes the supplied header and payload readable. It does not prove who created the token, whether it was modified, or whether any declared algorithm or key identifier can be trusted.
How do I read the exp, iat, and nbf claims?
These claims use NumericDate values: seconds since 1970-01-01 00:00:00 UTC. The decoder preserves each original value and displays an ISO 8601 UTC date only when the claim is numeric and within the JavaScript date range.
Is my JWT uploaded to a server?
No. Decoding runs locally in your browser and uses in-memory state only. The token is not submitted to a server, stored in browser storage, placed in a URL, or sent to an issuer or key endpoint.
Can JWT payloads contain sensitive information?
Yes. Readable JWT payloads can contain personal or security-sensitive claims. Base64url is an encoding, not confidentiality protection, so do not assume a payload is secret merely because it looks encoded.
Why does my token fail to decode?
Common reasons include the wrong number of segments, illegal Base64url characters, malformed padding, invalid UTF-8, invalid JSON, array or primitive JSON roots, a detached payload, or an unsupported unencoded payload.
Can this tool decode encrypted JWTs?
No. Compact JWE tokens contain five segments and require decryption keys and cryptographic processing. This tool rejects them and does not accept keys, fetch issuer metadata, or contact JWKS endpoints.