zippydevtoolsEncoding
JWT Decode
Decode JWT header and payload JSON locally, then inspect algorithms, audiences, and registered time claims without signature validation.
- This decoder reads token structure and claims but does not validate signature, authenticity, issuer, audience, or authorization.
- The JWT, decoded JSON, and claim values stay in the browser and never enter analytics, URLs, or persistent storage.
- Treat decoded claims as untrusted input until the accepting application verifies its key and policy.
Decode a JWT in your browser, read header and payload JSON, and inspect its algorithm, audience, and registered time claims without uploading the token.
When to use
Use this workflow while debugging authentication, reviewing a Bearer token, checking registered claims, or investigating why a token appears expired or not yet valid.
Input
Paste a compact three-segment JWT with or without the Bearer prefix. Whitespace is normalized and the post-normalization limit is 16 KB.
Output
Read warnings and temporal status first, then compare header and payload with the application configuration. Decoding never proves authenticity.
- Paste the JWT or Bearer token in the input panel.
- Choose Decode JWT to separate header, payload, and claim inspection.
- Review algorithm, issuer, audience, and exp, nbf, and iat dates.
- Copy only the needed section and verify the signature in the system that owns the trusted key and policy.
- Authentication debugging: Confirm issuer, audience, subject, and scopes before investigating backend validation.
- Expiration review: Compare exp and nbf with the inspection time and read iat as a formatted date.
- Integration inspection: Compare alg, typ, and kid in the header with the provider's documented configuration.
- Unverified signature: Anyone can construct a decodable payload. Treat every claim as untrusted until cryptographic verification succeeds.
- Clock tolerance: Temporal status uses the browser clock without clock skew. The accepting service may apply a different tolerance.
- Audience arrays: The aud claim can be one string or a list; inspection preserves every declared string audience.
- Unsupported JWE: Encrypted JWE tokens normally use five segments and are outside this signed or unsecured compact-JWT workflow.
- Base64 Decode Is Not Decryption: Practical Guide
Choose standard Base64 or Base64URL, understand padding and UTF-8 errors, and avoid treating decoded text as decrypted or authenticated data.
Inspect authentication claims
Input: Bearer eyJhbGciOi...
Output: Readable header and payload JSON with issuer, subject, audience, and token ID summaries.
Review token expiration
Input: JWT with exp, iat, aud, and scope claims
Output: Formatted timestamps and an active, expired, or not-yet-valid temporal status.
Spot an unsecured algorithm
Input: JWT with alg set to none
Output: An algorithm warning beside the decoded header, without treating the token as verified.
Does JWT Decode validate token signature?
No. It decodes header and payload and summarizes claims, but it has no trusted key or application policy. Verify the signature, expected algorithm, issuer, audience, and time rules in the system that accepts the token.
Is my token sent to a backend?
No. Decoding, claim summaries, temporal comparison, and copy actions stay in the browser. Analytics receives only the tool, category, locale, and action, never the JWT or claim values.
Can I paste tokens with Bearer prefix?
Yes. Bearer prefix is removed automatically before decoding.
When do I get invalid token errors?
The decoder expects compact JWT shape with three dot-separated segments and decodable Base64URL JSON in the first two. Encrypted JWE tokens normally have five segments and are not supported here.
What do exp, nbf, and iat mean?
They are NumericDate values in Unix seconds: exp marks expiration, nbf the earliest valid time, and iat the issue time. The tool formats them and compares exp and nbf with the inspection time without applying clock skew.
Why does a missing or none algorithm show a warning?
The header does not declare a verifiable signing algorithm. The warning supports manual review, but only the application with the expected key and policy can decide whether to reject the token.
What should I inspect after decoding a JWT?
Compare alg, kid, iss, aud, exp, nbf, and the application-specific claims with the issuing system. Use Base64 Decode only for standalone encoded data and JSON Validator when checking a separate JSON document.