Developer & Tech

JWT Decoder

What this does

Decode JWT header and payload claims with base64url-safe parsing, plus live expiry analysis against the current clock.

Enter your details

Runs in your browser

Calculator inputs

How to use it

Using the jwt decoder

  1. 01

    Paste the token

    Straight from localStorage, an Authorization header or a cookie.

  2. 02

    Read header and claims

    Algorithm, subject and issued-at appear alongside the full decoded payload.

  3. 03

    Check expiry honestly

    The exp row compares against your device clock right now.

Good to know

Decoding ≠ verification; the critical caveat

Anyone can decode any JWT; base64url is not security. An attacker can also craft tokens carrying whatever claims they like. Only the cryptographic signature, verified server-side with the shared secret or public key, proves a token was issued by you and unmodified. Never trust decoded claims until that check passes.

Claims worth inspecting

  • exp; expiry; expired tokens must be rejected regardless of appearance
  • iat; issued-at, useful for spotting clock skew
  • alg; “none” is a red flag; downgrade attacks exploited it historically
  • sub / roles; confirm identity claims match expectations

How it's calculated

The math behind this calculator

token = base64url(header).base64url(payload).signature; decoded, signature NOT verified

The token splits into its three dot-separated segments. Header and payload are base64url-decoded (with padding restored) and parsed as JSON objects; claims such as alg, sub, iat and exp surface as labeled rows alongside the pretty-printed payload.

When an exp claim exists, it is compared against the current time at the moment you run the tool, reported as either “valid for …” or “expired … ago”. The signature segment is deliberately left alone; verifying it requires the secret key, which should never be pasted into a website.

Assumptions & limitations

  • Tokens follow the compact JWS serialization header.payload.signature.
  • Timestamps are Unix seconds per RFC 7519.
  • Signature verification must happen server-side with the real key.

Worked example

Pasting the canonical sample token reveals its HS256 header and a payload naming Ada Lovelace; readable instantly because JWTs are merely encoded, not encrypted.

FAQ

Frequently asked questions

Is pasting a JWT here safe?
Decoding runs locally in your browser. Still, access tokens are credentials; avoid pasting live production tokens anywhere as a matter of hygiene.
Why is the signature shown but not checked?
Verification needs the signing key, which only your server holds. A browser tool cannot; and should not; possess it.
What does “expired X ago” use as its clock?
Your device’s current UTC time at the instant of calculation, compared against the exp claim in Unix seconds.
My token has extra dots; why the error?
JWS compact serialization defines exactly three segments. Four-part tokens belong to JWE (encrypted JWTs), which this decoder does not open.

Keep exploring

Related calculators