JWT Decoder
Decode Base64URL-encoded JWT headers and payloads locally to inspect standard claims and expiration status.
Paste a JWT string below. Decoding happens 100% locally and does not verify cryptographic signatures.
Algorithm (alg)
—
Type (typ)
—
Expiration Status
—
Standard Registered Claims (RFC 7519)
| Claim | Decoded Value |
|---|
About the JWT Decoder & Security Notice
A JSON Web Token (JWT, RFC 7519) consists of three Base64URL-encoded parts separated by dots: header.payload.signature. Because the header and payload are merely Base64URL-encoded (not encrypted), anyone with the token can read its claims.
Important Security Notice
- Decoding Does Not Verify Signatures: Inspecting a decoded payload only shows what the token claims; it does not verify that the signature was signed by a trusted key.
- Never Share Production Secrets: This tool intentionally never asks for HMAC signing secrets or private keys.
Standard JWT Claims
iss(Issuer),sub(Subject),aud(Audience).exp(Expiration Time),nbf(Not Before),iat(Issued At) in Unix epoch seconds.