Security & Encoding
JWT Decoder
Decode a JSON Web Token's header and payload. Standard claims are displayed in human-readable form. Your token is never transmitted or saved to storage.
● LOCAL
● NO NETWORK
● NO INPUT STORAGE
● RFC 7519
⚠ Decoding is not verification. This tool decodes the token header and payload but does not verify the signature. A decoded token is not a validated token — anyone can forge the payload without the secret key. Do not paste real production or session tokens into any online tool.
Unix Timestamps in Claims: Standard claims like
exp, nbf, and iat are stored as integer epoch seconds. To inspect or perform math on timestamps, use the Unix Timestamp Converter. To inspect base64 encoding directly, use the Base64 & Base64URL Tool.
About JSON Web Tokens & Security
What it does
A JSON Web Token (JWT) consists of three Base64URL-encoded parts separated by dots: header.payload.signature. This tool decodes the header (algorithm and token type) and the payload (claims such as expiry, subject, and issuer) and displays them with human-readable timestamps. The signature block is shown for informational purposes but not cryptographically verified.
Standard claims recognized
exp (expiry), iat (issued at), nbf (not before), sub (subject), iss (issuer), aud (audience), jti (JWT ID). Timestamps are rendered as both UTC and local time with dynamic expiration countdowns.
Zero Persistence: Your token is never stored. JWT input is strictly excluded from localStorage and cookies. No part of the token is sent to any server, logged, or included in analytics events.
Common mistakes
- Treating decoded as verified: Decoding only base64-decodes the payload. The signature is not checked — a crafted token with any payload will decode successfully.
- Pasting production tokens: Even though this tool runs locally, avoid pasting real session or access tokens into any browser tool.
- Ignoring
exp: An expired token may still decode successfully but should be rejected by your server.
Limitations
- Signature verification (HMAC, RSA, ECDSA) is not implemented — only decoding.
- Encrypted JWTs (JWE) are not supported — only signed JWTs (JWS).