ToolVaults

JWT Decoder

Paste any JSON Web Token (JWT) to see the decoded header, payload, and expiration status. Everything happens in your browser — the token never leaves your device.

Runs 100% in your browser — nothing is uploaded.Use this in a chain
issued 2018-01-18T01:30:22.000Z
Header
{
  "alg": "HS256",
  "typ": "JWT"
}
Payload
{
  "sub": "1234567890",
  "name": "John Doe",
  "iat": 1516239022
}
Signature
SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

Signature verification is not performed here — we don't have your signing key, and you should never paste it into a browser tool.

How to use

  1. 1
    Paste the JWT

    Three base64url segments separated by dots: header.payload.signature.

  2. 2
    Read the decoded header

    Algorithm (alg), token type (typ), and any custom header fields.

  3. 3
    Read the payload claims

    Standard claims (iss, sub, aud, exp, iat, nbf) plus any custom claims you added.

  4. 4
    Check expiration

    If exp is in the past, the token is stale. If nbf is in the future, it is not yet valid.

Examples

Standard access token
Input
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0IiwibmFtZSI6IkFsZXgiLCJpYXQiOjE3MzU2ODk2MDB9.abc123
Output
Header: { "alg": "HS256", "typ": "JWT" }
Payload: { "sub": "1234", "name": "Alex", "iat": 1735689600 }
HS256 signed. iat renders as 2025-01-01T00:00:00Z next to the raw number.
Token with expiration
Input
eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiI0MiIsImV4cCI6MTcwMDAwMDAwMH0.xyz
Output
Payload: { "sub": "42", "exp": 1700000000 }
Status: expired (2023-11-14T22:13:20Z)
The exp check is done client-side against your system clock.

Frequently asked

Do you verify the signature?

No — verifying a signature requires the signing key, and pasting a signing key into any browser tool is a security anti-pattern. Verify signatures in your server code with a library like jose or jsonwebtoken.

Is my token safe to paste here?

The token never leaves your browser. We do not log, store, or transmit it. That said, avoid pasting production tokens into any tool — always use a scoped test token.

What claims does the tool understand?

It shows the raw JSON of both header and payload, and specifically highlights iat (issued-at), nbf (not-before), and exp (expiration) with human-readable timestamps.

Related tools