Utiltown

JWT Decoder

Paste any token into this JWT parser to decode a JWT header and payload entirely in your browser — the token decodes live as you type. We never validate signatures and never upload your token; the last input can stay in your own browser's local storage between visits and is clearable at any time from the Privacy page. Paste a JSON Web Token, hit Decode, and read a clean, pretty printed breakdown of its header and payload claims.

All computations run locally in your browser, no data uploaded to server. 
  
  
 
How To Use
 
     
  1. Copy any JWT — for example from a login flow, an Authorization: Bearer header, a test fixture, or a development console.
    2.  
  2. Paste it into the field above. The input accepts whitespace around the token and ignores differences in line wrapping. Decoding runs live as you type (250 ms after you stop); the Decode button re-runs it on demand.
    3.  
  3. Click Decode. The header and payload are rendered as two readable, pretty printed JSON blocks.
    4.  
  4. Read the time claims at a glance: exp, iat, and nbf are shown as human-readable UTC dates with relative times, and an expired badge appears when exp has passed. A token with alg: none is flagged as unsigned.
    5.  
  5. Click Copy result to copy the combined header and payload JSON to your clipboard.
    6.  
 
 
 
Usage Example
 
Take a compact token such as:
 
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjMiLCJpYXQiOjE3NjcyMjU2MDAsImV4cCI6MTg5MzQ1NjAwMH0.E9Fs_JrhJ2nL8512aXgGMDbVQaB5Bc1FcrWAiW9xrJY
 
Decoding it reveals two parts:
 
Header
{
  "alg": "HS256",
  "typ": "JWT"
}

Payload
{
  "sub": "123",
  "iat": 1767225600,
  "exp": 1893456000
}
 

The header tells you how the token was signed, and the payload holds
        the claims — the pieces of identity and metadata the token represents.
        The time claims are decoded for you: iat and
exp are rendered as human-readable UTC dates with a
        relative time, and a red expired badge appears once
exp is in the past. The long third segment is the
        signature, which this tool intentionally shows nothing about — a
        persistent note above the output reminds you that the signature is
        never verified here.

 
 
 
Frequently Asked Questions
  
What is a JWT?
 
A JSON Web Token (JWT, pronounced "jot") is a compact, URL-safe way to carry claims between two parties, most often used for authentication and authorization. It is built from three Base64Url-encoded segments separated by dots: header.payload.signature. The header describes the signing algorithm, the payload contains the claims such as a user ID or expiry time, and the signature lets a server verify the token has not been modified.
  
Why does this tool not validate the signature?
 
Validating a signature requires the signing key, which is only held by the server that issued the token. A client-side decoder cannot, and should not, verify it. This tool is an inspection utility: it shows you the readable contents of the header and payload so you can debug, learn, or develop against a token, without pretending to be a trusted verification endpoint.
  
Does the decoder detect if a token has been tampered with?
 
No. Because this tool never verifies the signature, it cannot tell you whether a token is genuine or has been altered. It only displays what is written in the header and payload. If you need to prove a token is authentic and unmodified, verify it on your server with the correct signing key.
  
Is my token uploaded anywhere?
 
No. The entire decode happens locally in your browser using plain JavaScript — nothing is ever sent to a server or logged. For convenience, the last token you pasted can be kept in your own browser's local storage so it is still there when you return; it never leaves your device, is listed on the Privacy page, and you can wipe it with that page's "Clear all stored data" button or by clearing your browser data.
  
Which algorithms are supported?
 
Every algorithm. This decoder simply reads the alg header claim to tell you what algorithm the issuer used — HS256, RS256, ES256, none, or anything else — but it does not execute or verify the signing algorithm. Because no cryptographic work is performed, the tool works with tokens produced by any algorithm.
  
What are the header, payload, and signature?
 
The header is a small JSON object identifying the token type and the signing algorithm, typically {"alg":"HS256"}. The payload is the JSON object of claims — identity, permissions, and metadata such as sub, iat, and exp. The signature is a Base64Url-encoded value computed over the header and payload with the signing key; it is what lets a server detect tampering.
  
 
Related Tools
 
 
Deep Dive