JWT Decoder

Paste a three-part JWT token, decode the header and payload, inspect claims, timestamps, algorithm, and signature text, then decide what still needs verification.

Decode bearer tokens, cookies, or OIDC responses while checking claim names and expiry.

Compare header JSON, payload JSON, known claims, time fields, and signature text in one view.

  • Decode JWT header and payload locally
  • Inspect exp, iat, nbf, issuer, audience, and scope
  • Copy decoded header or payload JSON

How to use JWT Decoder

Paste a complete JWT, read the decoded header and payload, then verify the token separately in the system that actually trusts it.

  1. 1

    Paste a complete JWT token

    Add only the token string with header, payload, and signature separated by dots, ideally from a local or test environment rather than a live bearer token.

  2. 2

    Read header, payload, and claim labels

    Check alg, typ, issuer, subject, audience, scope, role, email, exp, iat, nbf, and custom claims while comparing the decoded JSON with the token source.

  3. 3

    Separate decoding from verification

    Use the decoded fields for debugging, then validate issuer, audience, algorithm, key, expiry, and signature in your application or identity provider before trusting the token.

Header and payload JSON views

JWT Decoder turns the first two base64url token parts into formatted JSON so header metadata and payload claims are easy to scan side by side.

Registered claim breakdown

Common JWT claims such as iss, sub, aud, exp, nbf, iat, jti, scope, role, email, and nonce are labeled to speed up API debugging.

Expiration and time claim checks

The decoder converts exp, iat, nbf, and auth_time values into readable local dates and flags whether the token appears expired by timestamp.

Signature context without trust claims

The signature segment and algorithm are visible for inspection, but this page does not prove the signature against a trusted secret, PEM, JWK, or issuer.

Local browser decoding

Token parsing happens inside the browser workspace, which makes the tool useful for quick local debugging without sending JWT text to a Rune API.

Copyable decoded sections

Copy the decoded header or payload JSON after checking that sensitive claim values are safe to include in tickets, documentation, or test notes.

JWT Decoder privacy and processing

JWT Decoder works in the browser and does not need an account, but pasted tokens should still be treated like credentials until they expire or are revoked.

Processing Browser

JWT Decoder parses the token locally with browser JavaScript, base64url-decodes the header and payload, and calculates exp, iat, and nbf dates without uploading the token.

Storage None

JWT Decoder keeps pasted token text in the current browser state only; clearing or refreshing removes the decoded view unless you copied it elsewhere.

JWT Decoder account access

JWT Decoder does not require sign-in before showing decoded header, payload, claim, timestamp, and signature fields during regular use.

Before You Use JWT Decoder

Review these JWT Decoder notes before pasting bearer tokens, session cookies, authorization headers, or identity-provider output into the page.

Privacy

Use local development or test tokens whenever possible because a real JWT can grant access until it expires or is revoked.

Do not paste unrelated headers, cookies, request bodies, user emails, or client secrets around the token when you only need to decode JWT fields.

Accuracy

A readable JWT is not automatically valid; anyone with the token can base64url-decode header and payload, and trust depends on signature verification.

Do not make authorization decisions from this page alone; validate issuer, audience, algorithm, key, expiry, and token source inside your real application.

Compatibility

JWT Decoder expects three base64url-encoded parts separated by dots, so encrypted JWEs, opaque access tokens, SAML assertions, and API keys will not decode here.

If decoding fails, trim spaces, remove Bearer prefixes, check for line breaks, and confirm that both header and payload contain valid JSON.

Output

Copy decoded JSON only after removing sensitive claim values that should not appear in bug reports, screenshots, pull requests, or public support threads.

Use decoded claims to guide debugging, then test the token against the API, middleware, or identity provider that enforces the real authorization rules.

Limits

JWT Decoder handles one three-part JWT string in the browser; very large payloads, invalid base64url, or malformed JSON can slow or stop decoding.

Questions about JWT Decoder

What does JWT Decoder show?

JWT Decoder shows the decoded header, payload, signature segment, common claim labels, expiration status, and readable dates for exp, iat, nbf, and auth_time values.

Does JWT Decoder verify the signature?

No. This page decodes and displays JWT fields, but trusted signature verification must happen with the correct secret, public key, issuer, audience, and algorithm.

Is it safe to paste a production JWT?

Avoid pasting production JWTs into online tools when possible. Use short-lived development tokens, redact copied output, and revoke any token that may have been exposed.

Why are exp, iat, and nbf shown as dates?

Those registered claims are Unix timestamps. JWT Decoder converts them into readable dates so you can quickly spot expired, future, or unexpectedly old tokens.

4.5 (581 ratings)