JWT Decoder
Decode, inspect, and verify JSON Web Tokens — entirely in the browser
{
"alg": "HS256",
"typ": "JWT"
}{
"sub": "1234567890",
"name": "John Doe",
"iat": 1516239022
}How to use
- Paste a JWT into the input box
- Review the decoded header and payload
- Inspect claim analysis (iat, exp, nbf) for validity
- Verify the signature with your HMAC secret
Use cases
- API debugging
- OAuth / OIDC integration
- Security research
- Token expiry checks
About the JWT Decoder
A JSON Web Token (JWT) is a compact, URL-safe credential format that encodes a signed JSON payload. It's the dominant format for modern authentication (OAuth 2.0, OIDC, API keys). Debugging one usually means decoding the Base64URL segments, checking the expiry, and verifying the signature — this tool does all three without ever sending the token over the network.
Features
- Decode header + payload as formatted JSON
- Registered-claim analysis: iat, nbf, exp, iss, sub, aud, jti with human-readable timestamps + relative time
- Visual expired / expires-soon / valid badges on exp and nbf
- HMAC signature verification (HS256 / HS384 / HS512) — constant-time compare
- Fully client-side — tokens never leave your browser
How it works
- Paste a JWT into the input box.
- The header and payload appear as formatted JSON with syntax highlighting.
- Scroll to 'Registered claims' to see iat / nbf / exp in human-readable form plus expiry warnings.
- If the token uses HS256/384/512, paste the secret and click Verify to confirm the signature is valid.
Frequently asked questions
Is my JWT sent to a server?
+
No. Decoding and HMAC verification both happen in your browser using the Web Crypto API. Tokens are safe to paste here.
Why can't you verify RS256 / ES256?
+
Those algorithms require the issuer's public key, which only the token issuer has. You can verify them on your own server with the public key; our tool handles HMAC (shared-secret) algorithms only.
What does 'Expires soon' mean?
+
A warning shown when the token will expire within the next 5 minutes — a common problem in failing deploys or clock-skew debugging.
Can I decode any JWT format?
+
Yes, any standards-compliant three-part JWT (header.payload.signature) with Base64URL encoding. Malformed tokens produce a clear error.
Are registered claims required?
+
No, JWTs can contain any custom claims. Our analysis table highlights the standard RFC 7519 registered ones; your custom claims still appear in the raw payload view above.