Programming tool
JWT Decoder
Inspect a JWT's header, payload, and registered claims locally—without claiming verification.
Decoding a JWT does not verify its signature.
Signature
—
How it works
The decoder splits a three-part JWT and decodes the Base64URL header and payload as UTF-8 JSON. Decoding a JWT does not verify its signature and never proves that a token is valid, authentic, or trusted.
Worked example
A typical token header identifies its type and algorithm, while the payload may contain iss, sub, aud, exp, nbf, iat, and jti claims.
How to use this tool
- Enter the known values and choose units where available.
- Check the primary result and supporting details.
- Clear or replace an input to calculate another case.
Privacy and security
Decoding occurs locally and token contents are never transmitted or logged. Even so, avoid pasting sensitive production credentials into tools unnecessarily. Treat decoded values as untrusted data until the signature and claims are verified by the intended application.
Frequently asked questions
What happens with invalid or incomplete inputs?
The result remains blank until the required inputs form a finite, meaningful calculation. Zero denominators and physically impossible negative quantities are not calculated.
Can I use decimal values?
Yes. The tool accepts decimals and keeps full precision for the calculation while rounding the displayed result for readability.
Does decoding prove that a JWT is authentic?
No. Decoding a JWT does not verify its signature. Anyone can construct or alter an unverified header and payload.
What are exp, nbf, and iat?
They are registered NumericDate claims for expiration, not-before time, and issued-at time. This decoder displays finite numeric values as human-readable UTC dates without judging token validity.