What does a JWT decoder do?

A JWT decoder parses the Base64URL-encoded header and payload segments of a JSON Web Token into readable JSON documents so you can inspect claims, algorithms, and timestamps.

Can a JWT be decoded without the secret?

Yes. JWTs are encoded using Base64URL, not encrypted (unless it is a JWE token). Anyone can decode and read the header and payload of a standard JWS token without the secret key.

Does decoding a JWT verify its signature?

No. Decoding reads the token structure and claim values. Verifying a signature requires checking the cryptographic hash or digital signature against a secret key or public key.

What do exp, iat, and nbf mean in a JWT?

exp is Expiration Time, iat is Issued At time, and nbf is Not Before time. They are NumericDate values representing Unix timestamp seconds.

Why can a JWT have an invalid signature even when it can be decoded?

Decoding only reads Base64URL text and does not prove authenticity. A signature can fail because the token was changed, the wrong verification key or algorithm was used, or the issuer is not trusted.

What is the difference between JWS and JWE?

JWS (JSON Web Signature) has 3 segments and provides integrity with readable payload claims. JWE (JSON Web Encryption) has 5 segments and encrypts the payload so it cannot be read without a key.

Does this tool upload or store my JWT?

No. All decoding and timestamp parsing run 100% locally in your browser. Tokens are never uploaded to a server, stored in persistent history, or sent to analytics.

Processed locally

JWT Decoder Online

Decode JSON Web Tokens locally, inspect header and payload claims, review exp, iat and nbf timestamps, and understand token structure without uploading the token.

Overview

What this tool does

JWT Decoder decodes JSON Web Tokens (JWS and JWE headers) locally in your browser. It breaks tokens into Header, Payload, and Signature segments, converts exp, iat, and nbf NumericDate timestamps into UTC and local dates with active/expired status, identifies alg=none and encrypted JWE payloads, and generates sanitized AI-ready debug summaries without uploading tokens or secrets to a server.

Workflow

How to use

Follow the core workflow below. Use “Show in tool” to locate the real control in the live tool above.

Paste the JWT you want to inspect
Add the compact JWT token or choose a synthetic sample. The decoder reads the token locally and does not send it to an authentication server.
JWT tokenSample
Decode the token locally
Run Decode JWT after adding the token. This reveals the readable structure and claims but does not verify the signature.
Decode JWT
Review the token structure
Check the decoded header, payload availability, segment count, and algorithm before interpreting claims.
HeaderPayload / ClaimsSegmentsAlgorithm
Check claims and token timing
Inspect standard and custom claims, then review exp, nbf, and iat as UTC and local times with their current status.
Claimsexpnbfiat
Check warnings and signature status
Review expiration, alg=none, encrypted-token, and structure warnings. Decoding does not verify the token signature without the required verification key.
WarningsSignature presentSignature verified
Copy only the decoded information you need
Copy the header, payload, a claims summary, or preview a redacted AI-ready debugging context without copying the raw token automatically.
Copy header JSONCopy payload JSONCopy claims summaryPrepare AI-ready context

Success

You can inspect token claims and timestamps locally, review security diagnostics, and copy safe summaries.

Prepare AI-ready context

Practical cases

Examples

Standard HS256 / RS256 JWS

Inspect header algorithm, token type, and payload claims with human-readable timestamps.

Expired token inspection

Check exp timestamp status relative to local time to verify token expiration.

Not-before claim (nbf)

Review nbf timestamp status to verify whether a token is already valid or pending.

Unsecured token (alg=none)

Detect insecure alg=none tokens with explicit security warnings.

Encrypted token (JWE 5-segment)

Identify 5-segment JWE structure and inspect header while flagging encrypted payload.

Troubleshooting

Common errors

Treating decoding as cryptographic signature verification (decoding only reads claims; verification requires the secret/public key).
Confusing NumericDate seconds with milliseconds (JWT timestamps use seconds since Unix epoch).
Assuming any three-part Base64URL string is trustworthy without verifying its issuer and signature.
Pasting raw bearer tokens into external AI tools or logs instead of using sanitized claim summaries.
Expecting encrypted JWE payload text to be decodable without the decryption key.

From evidence to action

AI workflow

Use Prepare AI-ready context to preview a sanitized Markdown context containing token structure, algorithm, claim key names, timestamp statuses, signature presence, and warnings. Raw tokens, signature bytes, and sensitive claim values are excluded by default.

Developer guides

Learn with this tool

Understand the concept, inspect a testable example, then open it in the tool above.

Security & CertificatesJWT Structure: Header, Payload and Signature Security & CertificatesJWT Claims Explained: exp, iat and nbf Security & CertificatesDecode vs Verify JWT: What’s the Difference?

FAQ

JWT Decoder Online

What this tool does

How to use

Paste the JWT you want to inspect

Decode the token locally

Review the token structure

Check claims and token timing

Check warnings and signature status

Copy only the decoded information you need