JWT Decoder
Decode and inspect any JSON Web Token — header, payload, expiry, and signature, in milliseconds.
Zero Network Calls
Tokens are decoded entirely in your browser. Nothing is uploaded — verifiable in the Network tab.
Expiry Detection
Auto-flags expired tokens and shows iat/exp/nbf claims as both ISO timestamps and human-friendly relative times.
One-Click Copy
Copy the header or payload as pretty-printed JSON, ready to paste into a script or test fixture.
Frequently Asked Questions
Is signature verification supported?
No — verification requires your private key or shared secret, which should never be pasted into a public tool. Use a JWT library on your server to verify.
Does this work with RS256, ES256, and HS256?
Yes. Decoding the header and payload is the same regardless of the signing algorithm. The algorithm appears in the header so you know which library/key to use server-side.
Can I decode a token without internet?
Yes. Once the page is loaded, the decoder works fully offline because it uses only browser primitives.
Why are my tokens flagged as expired?
Tokens carry an exp Unix timestamp. The decoder compares exp to your local clock; if it is in the past, the token will not be accepted by any compliant server.
Part of the Tools Lab by Azeem Shafeeq