Dashboard
JWT Token Decoder
JWT Token Decoder & Inspector
Decode and inspect JSON Web Tokens locally. Real-time expiration countdown and claims auditing.
100% Offline
Business
Paste Token
Verify Signature (HMAC-SHA256)
Enter the secret key to verify if the token signature is valid:
No Signature Loaded
Token Integrity & Audit
Status:
Active
Expiry Time:
-
Time Remaining:
-
Header (Algorithm & Type)
{}
Payload (Data Claims)
{}
Standard Claims Reference
iss (Issuer)
Identifies the principal security authority that issued the JWT token.
sub (Subject)
Identifies the user, resource, or entity (subject) this token is authenticating.
exp (Expiration Time)
Identifies the expiration time after which this token is rejected.
aud (Audience)
Identifies the intended recipients or backend clients of this token.
Next Steps & Related Tools
Keep your workflow going with tools that pair well with this one.
AI Voiceover (Text-to-Speech)
Convert text scripts into natural AI voiceovers with multiple language accent op...
AI PDF Summarizer
Extract and summarize key points, themes, and actionable items from PDF files lo...
Visual Code Diff & Merge Tool
Compare two code blocks side-by-side or inline to highlight additions, deletions...
Hashtag Research & Set Builder
Enter your niche or campaign tags to get categorised, high-engagement hashtag su...
UTM Link Builder & Campaign Tagger
Generate campaign URLs with UTM parameters. Includes campaign history logs, stat...
Data Format Transformer
Convert data between JSON, YAML, XML, CSV and TOML formats instantly. Features a...
Frequently Asked Questions
Quick direct-answer guides about using this utility tool locally and securely.
Can I decode signatures signed with RS256 private keys?
The decoder can display and decode the headers and JSON payload claims for any RS256/ES256 token. However, signature validation is currently supported for HMAC-SHA256 (HS256) secrets.
How secure is inspecting security tokens on this site?
Since parsing uses client-side base64url decoding functions, sensitive tokens containing client keys, passwords, or emails are never sent across the network.
Is a JWT encrypted, or just encoded?
A JWT is encoded (using Base64URL), not encrypted — this means anyone with the token can read its header and payload contents, even without the secret key. The signature only proves the token hasn't been tampered with; it doesn't hide the data. Never store passwords or sensitive secrets inside a JWT payload.
What are the three parts of a JWT?
A JWT has three parts separated by dots: the Header (contains the signing algorithm and token type), the Payload (contains the claims — the actual data being transmitted), and the Signature (verifies the token hasn't been altered).
What does the "exp" claim mean, and how do I check if a token has expired?
"exp" (expiration time) is a Unix timestamp indicating when the token becomes invalid — after decoding, compare this value against the current time to see if the token has already expired, which is one of the most common causes of "401 Unauthorized" API errors.
What is the difference between decoding and verifying a JWT?
Decoding simply reveals the header and payload contents without checking authenticity — anyone can decode a JWT. Verifying additionally checks the signature against a secret or public key to confirm the token is genuine and hasn't been tampered with.
Is it safe to paste a production JWT into an online decoder?
Since decoding happens entirely in your browser with no server transmission, your token stays private — but as general security hygiene, avoid pasting live production tokens or private signing keys into any third-party website, and prefer testing with sample or expired tokens when possible.
What do common JWT claims like iss, sub, and aud mean?
"iss" (issuer) identifies who created the token, "sub" (subject) identifies the user the token is about, and "aud" (audience) identifies who the token is intended for — these are standard, though optional, claims defined in the JWT specification.