JWT Decoder
Decode JSON Web Tokens to inspect header and payload JSON. Explains signature limits—client-side only; never paste production secrets you cannot rotate.
By Utilix Editorial Team · Added Apr 29, 2026 · Updated Oct 3, 2026
Input
Result
Enter a value for jwt token to see your result.
How it works
Decodes a JSON Web Token (JWT) without verifying the signature. Shows the header (algorithm and token type), the payload (claims such as subject, issuer, and expiry), and token metadata. The signature is not checked — this is a debugging tool only.
Step by step
- 01Split the JWT on '.' to get the three parts: header, payload, signature.
- 02Base64URL-decode the header and payload sections.
- 03Parse each as JSON and display the claims.
- 04Extract the 'exp', 'nbf' and 'iat' claims (Unix timestamps) to show human-readable times, a live expiry countdown and the token lifetime.
- 05Run security checks: unsigned tokens (alg none), missing expiry, very long lifetimes, clock skew and risky header fields such as jku.
- 06List every claim in a table with a plain-English meaning for standard claims like iss, sub, aud and scope.
Examples
Decode a sample JWT
The header reveals HS256 algorithm, the payload shows sub and name claims.
Inputs
- JWT token:
- eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
Result
- Header:
- { "alg": "HS256", "typ": "JWT" }
Frequently asked questions
How do I tell if a JWT is expired?
Read the `exp` claim — it is a Unix timestamp in seconds. If it is earlier than the current time, the token is expired. This decoder shows the expiry date and a live countdown (or how long ago it expired) and flags expired tokens in the security checks.
Is it safe to paste my JWT here?
This tool runs entirely in your browser — no data is sent to any server. However, avoid sharing JWTs with sensitive claims (e.g., access tokens) in untrusted environments.
Does this verify the JWT signature?
No. This is a decoding tool for inspection and debugging. Signature verification requires the secret key or public key and should be done on your server.
Why can I decode a JWT without the secret — is that insecure?
JWT payloads are only Base64URL-encoded JSON; anyone can read them. Security comes from the signature (HMAC/RSA/ECDSA) proving the issuer. Never put secrets in claims unless they are encrypted (JWE) for the recipient.
What do exp, nbf, and iat mean?
`exp` is expiration time, `nbf` is not-before, and `iat` is issued-at — all typically in seconds since Unix epoch unless using stringdate claims. Your API gateway should enforce `exp` even if the token still decodes.
Can I paste refresh tokens or long-lived admin tokens?
You should not paste highly privileged tokens into any online or shared device tool. Prefer decoding copies of expired sample tokens, or use local CLI utilities in a locked-down environment.
Is 'decoding' a JWT the same as 'decrypting' it?
No — a standard JWT (JWS) isn't encrypted, so there's nothing to decrypt: the header and payload are just Base64URL-encoded JSON, and this tool reverses that encoding. A JWE (encrypted JWT) is different and rarer — it requires the recipient's private key to decrypt, which this tool does not do.