JWT Decoder
Decode JWT (HS256, RS256, etc). Parse header, payload, signature, expiration timer, standard claims. 100% offline.
About this tool
Decode JSON Web Tokens without sending them anywhere. Paste any JWT and see the three parts — Header (algorithm, type, key ID), Payload (all claims with descriptions of the standard ones like iss, sub, aud, exp, nbf, iat, jti), and Signature (the raw base64url). The expiration claim is highlighted with a colored dot — green if still valid for an hour or more, amber if expiring soon, red if already expired. Each section has a Copy button to copy the parsed JSON. Fully offline — tokens never leave your browser.
Details
- Category
- developer
- Version
- 1.0.0
- Size
- 11 KB
- Updated
- Jun 2026
Frequently Asked Questions
Is my token sent anywhere?
No. Decoding happens entirely in your browser using the standard atob function. Your token is never uploaded, never logged, never shared. The only storage is localStorage, and only because that is convenient for the textarea.
Does this verify the signature?
No. Decoding is base64url unpacking — it shows you what is in the token but does not prove it has not been tampered with. Signature verification requires the right algorithm (HMAC for HS*, RSA/ECDSA for RS*/ES*) and the secret or public key. Use a JWT library like jsonwebtoken, jose, or pyjwt for verification.
What do the standard claims mean?
iss = issuer, sub = subject (user ID), aud = audience (intended recipient), exp = expiration time (Unix seconds), nbf = not before (Unix seconds), iat = issued at (Unix seconds), jti = unique JWT ID. Anything else is a custom claim from the issuing system.
What is base64url?
It is like regular base64 but URL-safe: - replaces + and _ replaces /. JWTs use base64url to avoid characters that need URL encoding. Standard base64 decoders often fail on it; we handle the swap automatically.