Runs locally in your browser. Your input is not uploaded.
JWT Decoder
Securely decode JSON Web Tokens. Inspect the header structure, inspect payload claims, and verify expiration dates without risking token exposure.
Encoded JWT
Security Note: Decoded locally. Signature is not verified. Never trust a JWT without verifying its signature cryptographically on your backend.
Decoded Data
Header (Algorithm & Token Type)
Payload (Data & Claims)
Signature (HMAC / RSA)
About this Tool
The JWT (JSON Web Token) Decoder is a critical debugging instrument for dissecting Base64Url encoded tokens into their constituent header, payload, and signature segments, enabling developers to inspect claims and expiration data instantly.
How It Works
The tool splits the standard JWT string by the `.` delimiter. The first two segments (Header and Payload) undergo a Base64Url decoding process and are parsed into formatted, syntax-highlighted JSON objects via `JSON.parse()`. The signature block is presented as raw bytes.
How to Use
- Paste your full, three-part JWT string into the primary input area.
- Inspect the decoded Header to verify the signing algorithm (e.g., RS256, HS256).
- Review the Payload to examine standard claims like `exp` (Expiration), `sub` (Subject), and `iat` (Issued At).
Examples
Typical Auth Payload
Standard token structure defining user roles and expiry.
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQTechnical Notes
- FINANCIAL DISCLAIMER: This calculator provides structural estimates based on user-provided assumptions and broad, jurisdiction-level tax models. It does NOT constitute professional tax, legal, or financial advice. Actual self-employment tax liability depends on your specific business structure, elected tax treatment, applicable deductions, and the relevant fiscal year. Always consult a qualified tax professional before making financial decisions.
- Important: This tool decodes the token strictly for inspection; it does NOT cryptographically verify the signature against a public key or secret.
- Standard epoch claims (`exp`, `iat`) are automatically translated into human-readable local time formats for easier debugging.