JWT Decoder splits a JSON Web Token into its three dot-separated segments, base64url-decodes the header and payload, and renders both as formatted JSON. JWTs are not encrypted — the "encoding" is just base64url, a reversible transform — so anyone holding a token can read every claim inside it. This tool makes that inspection instant: paste a token from a Set-Cookie header, an Authorization header (the Bearer prefix is stripped automatically), or your auth provider's dashboard, and see exactly what your server put in there.
The claims table is where debugging actually happens. Registered time claims — exp (expiration), iat (issued at), and nbf (not before) — are Unix timestamps, useless to read raw. The decoder converts each to a human date and a relative time ("expired 3 hours ago", "expires in 14 minutes") and flags expired tokens in red. Most "401 Unauthorized, but the token looks fine" incidents come down to an expired exp, a clock-skewed nbf, or an aud claim that does not match what the API validates — all visible here in two seconds.
One thing this tool deliberately does not do: verify signatures. Verification requires the signing secret (HS256) or public key (RS256/ES256), and a client-side tool asking you to paste an HMAC secret would be teaching bad habits. Decoding is 100% client-side — the token never leaves your browser, hits no server, and appears in no request log, which matters because a live production JWT is a bearer credential. Anyone who has it, is you.
Drop the JWT into the input area. Grab it from the Authorization header in your browser DevTools Network tab, a cookie, localStorage, or a curl response. A leading "Bearer " prefix and surrounding whitespace are stripped automatically, so you can paste the full header value without cleanup.
Both segments render as formatted JSON side by side. The header tells you the signing algorithm (alg: RS256, HS256, etc.) and key ID (kid) — useful when your JWKS rotation is misbehaving. The payload holds the claims: sub, iss, aud, scopes, roles, and whatever custom data your auth layer added.
Time claims (exp, iat, nbf) are decoded from Unix seconds into readable dates with relative times. An expired exp shows in red with exactly how long ago it lapsed; a valid one shows in green with time remaining. If nbf is in the future — usually clock skew between your servers — the token will be rejected even though it "looks" fine.
This tool never checks the signature — that requires the secret or public key and belongs on your server, not in a browser tool. Never treat decoded claims as trusted input: an attacker can mint a token with any payload they want. Only a verified signature proves the claims came from your issuer unmodified.
Base64url decoding in pure TypeScript — both JSON segments formatted and readable immediately
exp claim flagged red when expired, green when valid, with exact relative time either way
exp, iat, and nbf converted from raw Unix seconds to ISO dates and "3 hours ago" style phrasing
Paste the whole Authorization header — "Bearer " and stray whitespace are stripped automatically
Generate MD5, SHA-1, SHA-256, SHA-384, and SHA-512 hashes from any text
Encode and decode text to/from Base64 format
Convert between Unix timestamps and human-readable dates
Format, validate, and minify JSON data
0 comments
No comments yet. Be the first to share your thoughts!