%url-decoder.net

JWT Decoder

Decode a JSON Web Token into its header and payload, inspect claims, and check expiry. Runs entirely in your browser.

Your token is decoded locally and never sent anywhere, so session and API tokens stay private.

What is a JSON Web Token?

A JSON Web Token (JWT, defined in RFC 7519) is a compact way to pass signed statements between systems, most often to prove who a user is after login. It looks like three blocks of letters and digits separated by dots. Each block is base64url encoded, which means the contents are not encrypted, only packaged; anyone holding the token can read the header and payload, and the signature exists so the receiving server can detect tampering.

The three parts of a JWT

PartContentsEncoding
HeaderAlgorithm (alg) and token type (typ)base64url of JSON
PayloadClaims: statements about the user and the token's lifetimebase64url of JSON
SignatureCryptographic signature over header.payloadbase64url of raw bytes

Registered claims (RFC 7519)

ClaimNameMeaning
issIssuerWho created and signed the token, often an auth server URL.
subSubjectWhom the token is about, usually a user ID.
audAudienceWhich service the token is intended for.
expExpirationUnix timestamp after which the token must be rejected.
nbfNot beforeUnix timestamp before which the token is not yet valid.
iatIssued atUnix timestamp of when the token was created.
jtiJWT IDUnique identifier, useful for one-time use or revocation.

Decoding is not verifying

Reading a token and trusting a token are different things. This tool shows you what a token claims, which is exactly what any attacker could also read. Whether those claims are genuine depends on the signature, and checking it requires the secret or public key of the issuer. Always verify signatures server-side with a maintained JWT library, reject tokens signed with "none", and pin the algorithms you accept.

Frequently asked questions

Is it safe to paste a JWT into this tool?
Yes. Decoding happens entirely in your browser with JavaScript; the token is never transmitted or stored. That said, treat production tokens like passwords: this tool cannot leak them, but your clipboard history or screen can.
Does this tool verify the JWT signature?
No. It decodes the header and payload, which are only base64url-encoded, not encrypted. Verifying the signature requires the issuer's secret or public key and should happen in your backend with a maintained JWT library.
Why does my token fail to decode?
A JWT must have exactly three parts separated by dots, each valid base64url. Common causes: the token was truncated when copying, it is an opaque session ID rather than a JWT, or it has five parts, which means it is an encrypted JWE that cannot be read without the key. A leading 'Bearer ' prefix is fine; this tool strips it automatically.
What do exp, iat, and nbf mean?
They are Unix timestamps (seconds since January 1, 1970 UTC). iat records when the token was issued, nbf says the token is not valid before that moment, and exp says it must be rejected after that moment. This tool converts all three to your local time and shows whether the token is currently expired.
What is the difference between a JWT and a JWE?
A signed JWT (JWS) has three parts and its contents are readable by anyone; the signature only proves integrity. A JWE has five parts and its payload is encrypted, so it cannot be inspected without the decryption key.

Related tools

URL Decoder

Decode percent-encoded URLs and text, detect double encoding and inspect every %XX sequence.

URL Encoder

Percent-encode a value, a full URL or form data, with strict RFC 3986 and +/%20 options.

URL Parser

Split a URL into scheme, host, port, path, query and fragment, with checks for common problems.

Query String Parser

Edit query parameters as a table, rebuild the string, or export it as JSON.

Base64 Encode/Decode

Convert text to Base64 and back, including the URL-safe Base64URL alphabet.

HTML Encode/Decode

Escape text to HTML entities and decode entities back to text.