Skip to content

JWT Decoder & Inspector

JWT Token0 chars
Paste a JWT token above to decode and inspect it

What This Tool Does

You can decode a JWT and read its header, payload claims, and expiration without sending the token anywhere: the decoder splits the three base64url segments and parses them entirely in your browser. Registered claims (iss, sub, aud, exp, nbf, iat, jti) are labeled, and exp is converted into a live expired-or-not countdown. Decoding does not verify the signature — no secret or key is involved.

Last updated:

This tool is provided as-is for convenience. Output should be verified before use in any production or critical context.

Programmatic Access

JWT Decoder & Inspector is also callable as a free HTTP JSON API at https://aidevhub.io/api/jwt-decoder/ — GET with query parameters or POST with a JSON body, no authentication, CORS enabled, 50 requests/day per IP. Responses return { ok, tool, result, meta }. 

curl -s "https://aidevhub.io/api/jwt-decoder/?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c"

Machine-readable contract: /api/tool/jwt-decoder.json All API endpoints: /agents/ LLM site index: /llms.txt

Agent Invocation

Best Path For Builders

Dedicated API endpoint

Deterministic outputs, machine-safe contracts, and production-ready examples.

Dedicated API

https://aidevhub.io/api/jwt-decoder/

OpenAPI: https://aidevhub.io/api/openapi.yaml

GET /api/jwt-decoder/ GET jwt-decoder
POST /api/jwt-decoder/ POST jwt-decoder

Unified Runtime API

https://aidevhub.io/api/tools/run/?toolId=jwt-decoder&a=...

GET and POST are supported at /api/tools/run/ with identical validation and limits.

Limit: 60 req / 60s, input max 128 KB.

How to Use JWT Decoder & Inspector

  1. 1

    Paste your JWT token

    Copy a JSON Web Token from your auth system (usually from Authorization header or localStorage) and paste it into the decoder.

  2. 2

    View decoded header and payload

    See the token's header (algorithm, type), payload (claims like sub, exp, iat), and signature. All three parts are decoded and displayed separately.

  3. 3

    Check expiry and validate claims

    Look at the `exp` (expiration) claim to see when the token expires. Check `iat` (issued at) and other claims to understand token validity.

  4. 4

    Verify signature with secret

    If you have the secret key, paste it to verify the signature. The decoder shows whether the signature is valid or tampered with.

  5. 5

    Inspect custom claims

    Review all custom claims (roles, permissions, user ID, etc.) in the payload. Use this to debug auth issues and understand token contents.

Frequently Asked Questions

What is JWT Decoder & Inspector?
JWT Decoder & Inspector decodes JSON Web Tokens and displays the header, payload, claims, and expiration details in a readable format. It's a must-have tool for developers working with authentication and authorization.
How do I use JWT Decoder & Inspector?
Paste your JWT string into the input field and the tool instantly decodes it, showing the header algorithm, all payload claims, and expiration status. It highlights whether the token is expired and displays timestamps in human-readable format.
Does JWT Decoder & Inspector store or send my data?
No. All processing happens entirely in your browser. Your JWT never leaves your device — nothing is sent to any server. This makes it safe for inspecting production tokens.
Can it verify JWT signatures?
The tool decodes and displays the header and payload without needing a secret key. Signature verification would require your secret or public key, so the tool focuses on safe, client-side inspection of token structure, claims, and expiration.

How do I decode a JWT and inspect its claims?

Paste the token into the input. A JWT is three base64url-encoded segments joined by dots — header.payload.signature — and the first two are plain JSON that anyone can decode without a key. The decoder validates the structure, parses header and payload, labels the registered claims, converts the timestamp claims into readable dates, and shows the signature bytes as hex.

Step by step

  1. Paste the full token (or press Sample JWT to see the format). Malformed tokens get a specific error: wrong segment count, invalid base64url characters, or non-JSON content.
  2. Read the header: the alg value is shown with its meaning (for example HS256 = HMAC using SHA-256).
  3. Read the payload: registered claims are listed with labels, custom claims separately, and the raw JSON below.
  4. Check the expiration badge — exp is compared against the current time and shown as a countdown or an "expired ago" notice.
  5. Copy header, payload, or signature hex out with one click.

JWT registered claims reference (RFC 7519)

Claim Name Meaning
iss Issuer Who created and signed the token.
sub Subject Who the token is about — typically the user ID.
aud Audience Which service the token is intended for; recipients must reject tokens aimed elsewhere.
exp Expiration Time Unix timestamp (seconds) after which the token must be rejected.
nbf Not Before Unix timestamp before which the token is not yet valid.
iat Issued At Unix timestamp of when the token was created.
jti JWT ID Unique token identifier, used to detect replay or support revocation lists.

The seven registered claim names from RFC 7519 section 4.1 — the set this decoder labels. All are optional; anything else in the payload is shown under custom claims.

Does decoding a JWT verify its signature?

No, and that distinction matters. The header and payload are only base64url-encoded, not encrypted, so decoding proves nothing about authenticity. Verification requires recomputing the signature with the issuer's secret (HS*) or public key (RS/ES/PS/EdDSA) — something a server must do before trusting any claim. This tool is an inspector: it shows what a token says, including tokens signed with alg: none, which any verifier should reject outright.

Why does my token show as expired?

exp is seconds since the Unix epoch, compared against your system clock. If a fresh token reads as expired, check for a milliseconds-vs-seconds mix-up on the issuing side (a millisecond value in exp lands tens of thousands of years in the future, while a truncated one reads as 1970) and for clock skew between issuer and verifier.

Is it safe to paste a live token into this page?

Decoding runs entirely in your browser; the token is never transmitted, stored, or logged. Still, treat any bearer token that has touched a clipboard as sensitive — it grants access until exp. Prefer inspecting expired or test-environment tokens, and rotate any production token you suspect has leaked.