What is a JWT Token?

A JSON Web Token (JWT) is a compact, URL-safe token format used for securely transmitting information between parties. JWTs are widely used in authentication systems, API authorization, and single sign-on (SSO) solutions.

Token Structure: Every JWT consists of three parts separated by dots (.), forming a string like: xxxxx.yyyyy.zzzzz

Header

Contains the token type and signing algorithm (e.g., HS256, RS256)

Payload

Contains the claims: statements about the user and additional metadata (e.g., user ID, email, roles, expiration time)

Signature

Used to verify the token hasn't been tampered with

This tool lets you decode and inspect any JWT token instantly, right in your browser — with complete privacy and security.

How to Use the JWT Decoder

Paste Your Token

Copy your JWT token and paste it into the input field. The token is decoded automatically as you type — no button clicks required.

View Decoded Parts

The Header and Payload are displayed as formatted JSON with syntax highlighting. The Signature is shown as a Base64URL string.

Check Expiration Status

The status bar shows whether the token is valid, expired, or not yet valid, along with a relative time indicator.

Explore Claims

Hover over any recognized claim name (like iss, sub, exp) to see a brief explanation of what it means.

Copy What You Need

Use the copy buttons on each panel to copy the decoded JSON or signature to your clipboard.

Quick Start Tip: Click the Sample button to load a demo token and see how the decoder works in action.

Features

Real-Time Decoding

The token is decoded instantly as you paste or type. No need to press a button — results update in real time.

Color-Coded Panels

Each part of the JWT is displayed in a separate panel with distinct color coding, making it easy to distinguish the Header, Payload, and Signature at a glance.

Claims Intelligence

Hover over standard claim names to see what they mean. The decoder recognizes common claims from the JWT specification, OpenID Connect, and OAuth 2.0.

iss, sub, aud — Issuer, Subject, Audience
exp, iat, nbf — Expiration, Issued At, Not Before
name, email, role — Common user claims

Automatic Timestamp Parsing

Unix timestamps in the payload (such as exp, iat, nbf) are automatically annotated with human-readable dates, so you don't have to convert them manually.

Expiration Status

The status bar clearly indicates whether the token is currently valid, expired, not yet valid, or has no expiration set, along with a relative time display.

Your Data Stays Private

All processing happens in your browser — ensuring complete privacy and security.

No server requests — Your token is never sent to any server
No storage — Nothing is saved or logged
No tracking — We don't collect any usage data

100% Client-Side: You can verify this by checking your browser's network tab — no requests are made when you paste a token.

Frequently Asked Questions

Is it safe to paste my JWT token here?

Yes, absolutely. This tool processes everything entirely in your browser. Your token is never sent to any server, stored, or logged. You can verify this by checking your browser's network tab — no requests are made when you paste a token.

100% client-side processing
No data transmission to servers
No storage or logging
Open-source and verifiable

Can this tool verify JWT signatures?

This tool is a decoder, not a verifier. It decodes and displays the token contents but does not verify the cryptographic signature. To verify a signature, you would need the signing secret or public key.

Decoder vs. Verifier: Decoding reads the token content, while verification confirms the token's authenticity using cryptographic keys.

What JWT algorithms are supported?

The decoder works with any JWT regardless of the signing algorithm. The algorithm is displayed in the status bar after decoding.

Supported algorithms include:

HMAC: HS256, HS384, HS512
RSA: RS256, RS384, RS512
ECDSA: ES256, ES384, ES512
RSA-PSS: PS256, PS384, PS512

Why does it show "Expired" for my token?

The token's exp (Expiration Time) claim contains a Unix timestamp. If the current time is past that timestamp, the token is considered expired.

This is normal: Most tokens have a limited lifetime for security reasons. Expired tokens should be refreshed or re-issued by the authentication server.

What are the colored dots next to Header, Payload, and Signature?

The color dots help you visually distinguish the three parts of a JWT token, following a common convention used by JWT tools:

Red represents the Header
Purple represents the Payload
Cyan represents the Signature