# JWT Decoder

- **URL:** https://codeasystem.com/calculators/developer/jwt-decoder/
- **Category:** developer
- **Description:** Decode JWT header and payload claims with base64url-safe parsing, plus live expiry analysis against the current clock.
- **Primary output:** Payload (decoded): {
  "sub": "1234567890",
  "name": "Ada Lovelace"
}

## Inputs
- JWT token (name: `token`, type: textarea, example: eyJhbGciOi…)

## Outputs
- Payload (decoded): {
  "sub": "1234567890",
  "name": "Ada Lovelace"
}
- Header (decoded): {
  "alg": "HS256",
  "typ": "JWT"
}
- Algorithm (alg): HS256
- Subject (sub): 1234567890

## Formula / methodology
```
token = base64url(header).base64url(payload).signature; decoded, signature NOT verified
```

The token splits into its three dot-separated segments. Header and payload are base64url-decoded (with padding restored) and parsed as JSON objects; claims such as alg, sub, iat and exp surface as labeled rows alongside the pretty-printed payload.

When an exp claim exists, it is compared against the current time at the moment you run the tool, reported as either “valid for …” or “expired … ago”. The signature segment is deliberately left alone; verifying it requires the secret key, which should never be pasted into a website.

## Assumptions & limitations
- Tokens follow the compact JWS serialization header.payload.signature.
- Timestamps are Unix seconds per RFC 7519.
- Signature verification must happen server-side with the real key.

## How to use
1. **Paste the token**; Straight from localStorage, an Authorization header or a cookie.
2. **Read header and claims**; Algorithm, subject and issued-at appear alongside the full decoded payload.
3. **Check expiry honestly**; The exp row compares against your device clock right now.

## Example
Pasting the canonical sample token reveals its HS256 header and a payload naming Ada Lovelace; readable instantly because JWTs are merely encoded, not encrypted.

Result for these inputs:

```
Payload (decoded): {
  "sub": "1234567890",
  "name": "Ada Lovelace"
}
```

## About this calculator
### Decoding ≠ verification; the critical caveat

Anyone can decode any JWT; base64url is not security. An attacker can also craft tokens carrying whatever claims they like. Only the cryptographic signature, verified server-side with the shared secret or public key, proves a token was issued by you and unmodified. Never trust decoded claims until that check passes.

### Claims worth inspecting

- exp; expiry; expired tokens must be rejected regardless of appearance
- iat; issued-at, useful for spotting clock skew
- alg; “none” is a red flag; downgrade attacks exploited it historically
- sub / roles; confirm identity claims match expectations

## FAQs
### Is pasting a JWT here safe?

Decoding runs locally in your browser. Still, access tokens are credentials; avoid pasting live production tokens anywhere as a matter of hygiene.

### Why is the signature shown but not checked?

Verification needs the signing key, which only your server holds. A browser tool cannot; and should not; possess it.

### What does “expired X ago” use as its clock?

Your device’s current UTC time at the instant of calculation, compared against the exp claim in Unix seconds.

### My token has extra dots; why the error?

JWS compact serialization defines exactly three segments. Four-part tokens belong to JWE (encrypted JWTs), which this decoder does not open.

## Related calculators
- [JSON Formatter & Validator](https://codeasystem.com/calculators/developer/json-formatter-validator/)
- [SHA Hash Generator](https://codeasystem.com/calculators/developer/hash-generator/)
- [HMAC Generator](https://codeasystem.com/calculators/developer/hmac-generator/)

---
Last updated: 2026-08-23 · Version: 1.0.0 · [HTML version](https://codeasystem.com/calculators/developer/jwt-decoder/)