What is this tool?
Inspect and decode the three structural components of a JSON Web Token (Header, Payload, and Signature) directly in your browser. Inspect expiration timestamps, token issuers, subjects, and custom claims.
When to use it?
Debug authentication headers, verify claims returned by OAuth/OpenID Connect identity providers (Auth0, Okta, Firebase, AWS Cognito), inspect token expiration status, or verify token algorithm headers.
How does it work?
Splits the period-delimited JWT string into its three segments (Header, Payload, Signature), normalizes the Base64URL encoding into standard Base64 with appropriate padding, decodes the UTF-8 byte stream into JSON objects, and computes expiration status against the client system clock.
Security Notice & Verification Context
Decode ≠ Verify. This tool inspects the structural claims of a JWT without verifying the cryptographic signature. Never trust token claims on a server without validating the signature using your public key (RS256/ES256) or secret key (HS256).
Operating Limits & Considerations
- This tool decodes unsigned, symmetrically signed (HS256), and asymmetrically signed (RS256/ES256) JWTs, but does not verify signature validity without access to private/public cryptographic key pairs.
- Encrypted JSON Web Tokens (JWE - RFC 7516) cannot be inspected without providing the corresponding decryption key.
Example Conversions
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkFsaWNlIiwiZXhwIjoxNzg0ODgwMDAwfQ.4v_secret_sig
Header: {"alg":"HS256","typ":"JWT"}
Payload: {"sub":"1234567890","name":"Alice","exp":1784880000}Standards & Technical References
Frequently Asked Questions
No. Decoding only translates the Base64URL payload into readable JSON. To determine authenticity and prevent tampering, your server must verify the cryptographic signature using your shared secret or identity provider public key.
exp (Expiration Time) defines when the token ceases to be valid; iat (Issued At) records the timestamp of token creation; nbf (Not Before) specifies the timestamp prior to which the token must not be accepted.