Decode JSON Web Token headers & payloads and check expiry — locally, nothing is sent anywhere — by Dinal Studios
⚠️ Read this first — decoding is NOT verification. A JWT's header and payload are only Base64URL-encoded, not encrypted — anyone who has the token can read them, including with this page. Decoding tells you what a token claims; it does not prove the token is genuine. Only the issuing server, using its secret/key, can verify the signature. Never paste production tokens, session tokens or real credentials into any website — including this one. This tool runs 100% locally and stores nothing, but building the habit of never sharing live tokens is what keeps you safe. Use test tokens only.
🔍 Decode a Token LOCAL ONLY
Paste a JWT below (a sample token is pre-loaded so you can see how it works). Decoding happens as you type.
● Header
The header names the signing algorithm (alg) and token type (typ).
—
● Payload (Claims)
The payload carries the claims — who the token is about, who issued it, and when it expires.
—
● Signature
The signature is the Base64URL of the cryptographic proof created by the issuer. This tool displays it — it cannot and does not verify it.
—
🎓 JWT Claims Cheat-Sheet
iss — Issuer: who created the token (e.g. your auth server).
sub — Subject: who the token is about (usually a user ID).
aud — Audience: which service the token is meant for.
exp — Expiry: Unix time after which the token must be rejected.
iat — Issued At: when the token was created.
nbf — Not Before: the token is invalid until this time.
Defender's checklist: always verify the signature on the server with the correct algorithm; enforce exp and aud; use short-lived access tokens; never store sensitive data in the payload (remember — anyone can read it); and transmit tokens only over HTTPS.
🔒 100% private: decoding happens entirely on your device. Nothing is stored, logged or transmitted.