Loading…
Decode and inspect JWT header, payload and expiry locally. Debug tokens securely in browser.
JWT Decoder is loading — interactive editor will appear here. Use examples below to try instantly once loaded.
Press ? for keyboard shortcuts
Decodes JSON Web Tokens with color-coded sections (header/payload/signature) for visual parsing. Automatically decodes standard timestamp claims (exp, iat, nbf) into human-readable dates, supports signature verification with secret/private key, and provides an expiry countdown timer with token analysis suggestions.
JWTs are opaque strings that encode important security information; manually base64-decoding and inspecting each section is tedious and error-prone. Provides instant visual decoding, security analysis, and expiry monitoring in one interface.
This tool is part of the DevStackIO platform — a collection of free online developer tools from DevStackIO. Browse more free developer resources on DevStackIO.
Backend developers, security engineers, API developers, and anyone working with JWT-based authentication or authorization systems.
Paste your JWT string into the input field; the tool automatically splits and color-codes the three sections
Review the header section (pink) showing algorithm type (HS256/RS256/etc) and token type (JWT)
Inspect the payload section (blue) with all claims auto-decoded; timestamp claims (exp, iat, nbf) show both raw epoch and human-readable date
Scroll to the signature section (green) showing the raw signature and signature verification options
Enter the secret or public key in the verification field and click "Verify" to check signature validity; results show Valid or Invalid
Monitor the expiry countdown timer that shows remaining seconds/minutes/hours until token expiration
Input: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkFsaWNlIiwiZXhwIjoxNzA0MDYwODAwfQ.abc123signature -> Output: Header: {alg:HS256,typ:JWT} | Payload: {sub:1234567890,name:Alice,exp:2024-01-01T00:00:00Z} | Expiry: Expired 2 years agoInput: JWT with exp claim of 9999999999 -> Output: Payload shows exp:9999999999 (November 20, 2286) | Countdown: 262 years remainingDoes it support JWE (encrypted) tokens?
No, this tool handles JWS (signed) tokens only, not encrypted JWEs.
Can it verify JWTs signed with RS256 or ES256?
Yes, if you provide the corresponding public key for asymmetric algorithms.
How does it handle custom claims?
All custom claims are displayed as-is in the payload section with their raw values.
Does it store or transmit the token anywhere?
No, all decoding happens client-side in the browser; no data is sent to any server.
Authoritative specifications, standards, and in-depth reading for JWT Decoder.
Create signed JWTs (HS256/RS256) from header+payload locally. Use when creating test tokens; for inspecting existing tokens use jwt-decoder, for Base64 parts use base64. Input: JSON header/payload + secret. Returns JWT string. 100% client-side.
Infer JSON Schema from sample JSON for validation. Use when authoring schemas; for validating instances use json-validator. Input: JSON ≤10MB. Returns JSON Schema draft. 100% client-side.
Generate MD5, SHA-1, SHA-256, SHA-384, and SHA-512 hashes for text. Copy or compare instantly.
Generate time-based OTP codes from authenticator secret. Use for 2FA testing; for random tokens use token-generator. Input: Base32 secret. Returns 6-digit code + QR. 100% client-side.
Free online JSON formatter and validator with syntax highlighting and error line numbers. Use as default for beautify+validate+minify in one place; for two-file comparison use json-diff, for schema generation use json-schema-generator. Input: JSON ≤10MB. Returns formatted JSON or line-numbered error. 100% private.
Free online Base64 encoder and decoder with URL-safe mode. Use as default for text; for split encode-only/decode-only URLs use base64-encoder/base64-decoder (aliases), for image files use image-to-base64. Input: text ≤10MB. Returns Base64 string or decoded text + error location. Convert instantly in your browser.
Compare two JSON documents and highlight added, removed, and changed keys with line-level diff. Use when comparing API responses or configs; for single-document formatting use json-formatter, for validation errors use json-validator. Input: two JSON texts ≤10MB. Returns highlighted diff. 100% client-side.
Compress JSON by stripping whitespace for smallest payload. Use when preparing production payloads; for readable output use json-formatter or json-beautifier. Input: JSON text ≤10MB. Returns minified JSON or line-numbered error. 100% client-side.