ToolVaults

JWT Decoder

Paste any JSON Web Token (JWT) to see the decoded header, payload, and expiration status. Everything happens in your browser — the token never leaves your device.

Runs 100% in your browser — nothing is uploaded.

issued 2018-01-18T01:30:22.000Z
Header
{
  "alg": "HS256",
  "typ": "JWT"
}
Payload
{
  "sub": "1234567890",
  "name": "John Doe",
  "iat": 1516239022
}
Signature
SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

Signature verification is not performed here — we don't have your signing key, and you should never paste it into a browser tool.

Frequently asked

Do you verify the signature?

No — verifying a signature requires the signing key, and pasting a signing key into any browser tool is a security anti-pattern. Verify signatures in your server code with a library like jose or jsonwebtoken.

Is my token safe to paste here?

The token never leaves your browser. We do not log, store, or transmit it. That said, avoid pasting production tokens into any tool — always use a scoped test token.

What claims does the tool understand?

It shows the raw JSON of both header and payload, and specifically highlights iat (issued-at), nbf (not-before), and exp (expiration) with human-readable timestamps.

Related tools