JWT Decoder
Decode and inspect JSON Web Tokens in real-time. View header algorithms, payload user claims, subject IDs, issued-at timestamps, and expiration times safely.
Step-by-Step Instructions
Paste Encoded JWT Token
Paste your compact JSON Web Token (`header.payload.signature`) into the decoder.
Inspect Decoded Claims
Instantly view formatted JSON for both Header (algorithm `alg`, type `typ`) and Payload claims (e.g., `sub`, `email`, `roles`).
Review Human-Readable Timestamps
Examine automatic UTC datetime conversions for `exp` (expiration), `iat` (issued at), and `nbf` (not before).
Check Token Validity Status
View instant expiration badge indicating whether the token is currently active or expired.
Key Features & Capabilities
- RFC 7519 compliant JSON Web Token (JWT) decoder supporting all major signing algorithms (HS256, RS256, ES256, EdDSA)
- Automatic Unix timestamp converter formatting `exp`, `iat`, `nbf`, and `auth_time` into human-readable local and UTC times
- Live token expiration countdown timer and status alert (Active / Expired)
- 100% client-side decoding with zero network transmission for secure handling of Auth0, Firebase, AWS Cognito, and Okta tokens
Frequently Asked Questions
How does JWT decoding work without a secret key?
A JWT is encoded using standard **Base64URL encoding**, not encrypted. The signature verifies that the token was not altered, but the header and payload claims are completely public and can be decoded by any client without needing the private signing key.
What are the standard registered JWT claims (RFC 7519)?
Standard registered claims include: `iss` (Issuer), `sub` (Subject / User ID), `aud` (Audience), `exp` (Expiration Time as Unix timestamp), `nbf` (Not Before Time), `iat` (Issued At Time), and `jti` (JWT Unique ID).
How do you check if a JWT has expired?
A JWT is expired if the current Unix epoch time (in seconds) is greater than the integer value in the `exp` claim. Our decoder compares `Math.floor(Date.now() / 1000)` against `payload.exp` and displays the exact time elapsed since expiration.
Is it safe to decode private production JWTs in this tool?
Yes. Our decoder runs 100% in your local browser JavaScript engine. No token strings, user emails, or permission scopes are ever logged, cached, or transmitted across the internet.
Related Utilities
Discover complementary online tools in the same workflow.
JWT Parser & Token Debugger
Decode JWT tokens to view header, payload claims, and expiration status without sending secrets anywhere.
JSON Formatter & Validator
Format, beautify, minify, validate, and view JSON data online with instant syntax highlighting and error detection.
Base64 Encoder & Decoder
Encode text or binary data into Base64 format or decode Base64 back into raw string format.
CSV to JSON Converter
Easily convert CSV data to clean JSON format. Turn tabular spreadsheets into structured JSON.
YAML to JSON Converter
Convert YAML configuration files into structured JSON for APIs and modern web tooling.
Hash Generator (SHA-256, SHA-512, MD5)
Generate cryptographically secure SHA-256, SHA-512, SHA-384, and SHA-1 hashes for any text.