JWT Decoder
Inspect JWT header and payload data without verifying the signature. Your work stays on this device whenever possible.
How to use JWT Decoder
- Paste the token into "JSON Web Token (JWT)"; a sample with subject 1234567890 is preloaded, and two or three dot-separated parts are accepted.
- Optionally type a key into "HMAC Secret Key (Optional - for local signature verification)" if you want the signature checked as well.
- Press "Decode & Verify JWT" to fill the red HEADER card and the purple PAYLOAD card, each with its own small "Copy" button.
- Read the summary strip below the cards: Algorithm, Expires At (exp) with an EXPIRED or ACTIVE marker, Issued At, Not Before, Subject, Issuer and Audience.
- Scroll the text report for the SIGNATURE STATUS line, which says verified, mismatch, or not verified.
Worked example
Decode the preloaded token. The header card shows {"alg":"HS256","typ":"JWT"}, and the payload card shows sub 1234567890, name Alex Doe, admin true, iat 1516239022 and exp 2520239022. Those convert to 2018-01-18T01:30:22Z and 2049-11-11T10:23:42Z, so the strip marks the token ACTIVE while your clock is earlier than that. With no secret, the signature line says it was not verified.
When to use this tool
- Checking which claims and expiry an identity provider actually put into a login token.
- Confirming an HS256 test token was signed with the secret from your local config.
- Explaining to a teammate why an API call returns 401 by showing an expired exp claim.
Important limitations
Decoding a JWT unpackages Base64URL-encoded JSON. It does not authenticate the token unless the signature is actively verified against your secret key.
Frequently asked questions
Does a successful decode mean the token is genuine?
No. Decoding merely unpacks Base64URL text that anyone can read. Trust requires a verified signature plus checks on issuer, audience and expiry done by your server. Treat every claim shown here as unverified input.
Which signature algorithms can be verified?
Only HS256, HS384 and HS512, using the secret you type and the browser's Web Crypto HMAC. Tokens signed with RS256, ES256 and other public-key algorithms are still decoded, but the tool states that local verification is not available.
Why does the sample report a mismatch with any secret?
The preloaded token carries a placeholder signature that matches no real key, so every attempt reports SIGNATURE MISMATCH. Paste a token you signed yourself with a known secret to see the verified message.
How is expiry decided?
The exp value is read as Unix seconds and compared with your device clock, then shown as ISO time, local time and a phrase like "expired 3d ago". A wrong system clock gives a wrong verdict, and the nbf claim is displayed but never flagged as not yet valid.
What happens when the header says alg none?
A red warning is added because unsigned tokens can be forged. The token is not rejected, since this is a viewer, and a token with only two segments simply reports that its signature was not verified.