DevBento logoDevBento
Tools/JWT Decoder

JWT Decoder

Decode and inspect JSON Web Tokens in your browser. View the header, payload claims, and expiration status without sending your token to any server.

Related Conversions
JWT Claims Explained: exp, iat, nbf, and Standard
Understand JWT token claims including exp, iat, nbf, iss, sub, aud. Covers clock skew, token refresh patterns, and common mistakes.
Decode Expired JWT Token: Check Token Expiry
Decode a JWT token with an expired exp claim to inspect the full payload. See exactly when it expired and troubleshoot authentication issues in your app.
Decode a JWT Token: See Header, Payload & Claims
Decode a sample JWT to see the header, payload claims (sub, iss, exp, iat), and signature. Covers JWT structure, Base64url encoding, and security gotchas.
Related Tools
b64Base64 Encoder / Decoder
Re-encode a decoded header or payload
{}JSON Formatter + Tree Viewer + Graph Visualizer
Paste JSON to pretty-print, minify, validate, or visualize as an interactive graph. Syntax highlighting, tree view, and graph view with export.
shaHash Generator
Generate MD5, SHA-1, SHA-256, and SHA-512 hashes from text or files. Uses the browser's Web Crypto API for SHA hashes with a pure JS fallback for MD5.
unixUnix Timestamp Converter
Convert Unix timestamps to human readable dates and vice versa. Live clock, timezone support, and auto detection of seconds vs milliseconds.
jwtJWT Generator
Generate signed JWT tokens for testing with HS256 and RS256 signing. Build tokens with standard claims, custom claims, and configurable expiration.

JWT Decoder: Inspect Tokens Instantly

Paste a JSON Web Token to decode its header and payload, check expiration status, and inspect individual claims. Everything runs in your browser. Your token is never transmitted anywhere.

How to Use

  1. Paste your JWT into the input field (it starts with eyJ)
  2. Review the header to see the signing algorithm (HS256, RS256, etc.) and token type
  3. Inspect the payload for claims like subject, issuer, expiration, and custom fields
  4. Check the expiry banner to see if the token is still valid or when it expired
  5. Copy individual sections using the Copy buttons on each panel

Understanding JWT Structure

A JWT is three Base64URL-encoded segments separated by dots: header.payload.signature. The header declares the algorithm used for signing. The payload carries the claims: standardized fields like iss (issuer), sub (subject), exp (expiration), and iat (issued at), plus any custom claims your application adds. The signature is computed over the header and payload using the algorithm specified in the header.

Tokens are not encrypted by default. Anyone who intercepts a JWT can read the header and payload. The signature only guarantees integrity, confirming that the token was created by someone with the signing key and hasn’t been modified since.

Standard Claims

  • iss (Issuer): who created the token (e.g., auth.example.com)
  • sub (Subject): the user or entity the token represents
  • aud (Audience): the intended recipient (your API, a service)
  • exp (Expiration): Unix timestamp when the token becomes invalid
  • iat (Issued At): Unix timestamp when the token was created
  • nbf (Not Before): Unix timestamp before which the token is not valid
  • jti (JWT ID): a unique identifier for the token, useful for revocation

JWTs encode the header and payload as Base64URL. The Base64 Encode/Decode tool explains how Base64 works and handles the standard alphabet. Need to convert the exp or iat timestamps to a readable date? Use the Unix Timestamp Converter. Want to examine the decoded JSON more closely? Paste it into the JSON Formatter. Need to verify a signature hash? The Hash Generator computes SHA-256 and other digests. See a worked example in the Decode a Sample JWT walkthrough.

🔒

Nothing you paste leaves this tab. Every tool runs entirely in your browser — no upload, no server, no account.

© 2026 devbento.dev · built local-first