← back to textytools.dev

JWT Decoder

Decode and inspect JSON Web Token contents and time claims without signature verification.

Algorithm
—
Issued At
—
Expires At
—
Not Before
—

About JWT: JSON Web Tokens are an open, industry standard (RFC 7519) method for representing claims securely between two parties. This tool decodes and displays the contents without signature verification.

Security Note: Token decoding is processed in this browser. The token is not sent to a server for decoding or signature verification. Avoid pasting production tokens containing sensitive data.

Ways to use JWT Decoder

Decode and inspect JWT claims

Decode a three-part JSON Web Token, inspect its header, payload, signature text, and time claims, and keep the compact token in view.

Inspect token claims

Read the decoded header and payload when debugging a token or an authentication flow.

Check time claims

See issued-at, expiration, and not-before values interpreted against the current device clock.

Review decoded JSON

Copy the decoded object or transfer it once to JSON Wizard for formatting and search.

How to use it

  1. Paste a compact three-part JWT into JWT Token.
  2. Inspect the decoded header, payload, signature text, and available time claims.
  3. Copy the decoded JSON or continue in JSON Wizard when you need a closer look.

What the decoder checks

Header and payload
The first two Base64url parts must decode to JSON before a result is shown.
Signature text
The third token part is displayed, but its cryptographic signature, issuer, audience, and trust chain are not verified.
Time claims
The exp, iat, and nbf claims are interpreted when present; expiration and not-before states use the current device clock.
Invalid input
Wrong part counts, invalid Base64url, and non-JSON headers or payloads produce an inline decode error.

Example

Compact JWT

eyJhbGciOiJub25lIn0.eyJzdWIiOiJmaXh0dXJlLXVzZXIifQ.synthetic

Decoded claims

alg: none · sub: fixture-user · signature: synthetic

Good to know

  • Decoded does not mean valid, authentic, trusted, or safe to use.
  • An expiration or not-before result describes the time claim, not the token signature.
  • Avoid pasting production tokens containing sensitive data, and clear the token when using a shared device.