JWT Decoder

When an API call comes back with a 401 and all you have is a long string starting with eyJ, this jwt token decoder tells you what is actually inside it. Paste the token and you get the decoded header, the full payload, every claim explained in plain English, and an instant verdict on whether the token is still valid or already expired. Everything runs in your browser tab — the token never leaves your machine, which matters, because a JWT is usually a live credential.

What This JWT Token Decoder Does

• 🔎 Splits the token into its three segments and colour-codes them, so you can see at a glance where the header ends and the signature begins
• 📋 Decodes the header and payload from base64url into syntax-highlighted JSON, including tokens with Unicode names, emoji, or non-Latin characters
• 🕒 Converts exp, nbf, and iat into readable UTC dates with a relative time next to each one — “in 8 years”, “11 months ago”
• ✅ Shows a status badge — Valid, Expired, or Not valid yet — so the jwt token decoder answers the “is this still good?” question before you read a single claim
• 📖 Explains registered claims (iss, sub, aud, jti, azp, scope) and common OIDC fields instead of leaving you to look them up
• 🔐 Optionally verifies the signature: an HMAC secret for HS256/HS384/HS512, or a PEM public key or JWK for RS, PS, and ES algorithms
• ⚠️ Flags the dangerous cases: alg: none, an empty signature on a signed token, an encrypted JWE, or a timestamp accidentally written in milliseconds
• 🧹 Accepts a pasted Authorization: Bearer … header and strips the wrapper for you, including line breaks from a wrapped terminal copy

How to Use It

The whole point of a jwt token decoder is that it should take one paste and no configuration:

1. Paste your token into the Encoded token box — the decode happens as you type, no button needed.
2. Check the badges the jwt token decoder puts at the top: algorithm, token type, and whether the token is valid, expired, or not usable yet.
3. Read the header and payload as formatted JSON, and copy either one with the 📋 button.
4. Scroll to Claims explained to see what each claim means and what the epoch timestamps translate to.
5. To verify the signature, paste the shared secret (HMAC) or the issuer’s public key (RSA/ECDSA) and press Verify signature.
6. No token handy? Press ⚡ Sample to load a demo token and its secret, and watch a successful verification end to end.

What a JWT Token Decoder Cannot Tell You

This is the part that trips people up, so it is worth being blunt about it. A JWT’s header and payload are only base64url-encoded, not encrypted — anyone who has the token can read them, and anyone can craft a token with any payload they like. Decoding proves nothing about who issued it. That is why this jwt token decoder keeps the signature check as a separate, deliberate step: the payload panel tells you what a token claims, and only a successful signature verification tells you whether to believe it.

Two failure modes are worth watching for. A token with "alg": "none" carries no signature at all, and a server that accepts it will happily trust a payload an attacker edited by hand. And a valid signature on an expired token is still an expired token — the tool says so explicitly rather than showing a green tick and letting you assume the request should have worked. Signature verification in this jwt token decoder uses the browser’s built-in Web Crypto API, so your secret or public key is used locally and never transmitted.

Practical Use Cases

Where a jwt token decoder earns its place in a homelab or development workflow:

• 🚪 Debugging a 401 — find out in seconds whether the request failed because the token expired, because aud points at a different service, or because a scope is missing.
• ⏱ Checking session lifetimes — read the gap between iat and exp to see how long your identity provider actually issues tokens for, and cross-check raw epoch values with the Unix Timestamp Converter.
• 🔑 Confirming a key rotation — check the kid in the header and verify the token against the new public key before you retire the old one.
• 🏠 Wiring up self-hosted auth — when you put Authelia, Authentik, or Keycloak in front of your services as part of secure remote access to a home server, this jwt token decoder shows exactly which claims your reverse proxy is receiving.
• 🧪 Reviewing what a token leaks — a JWT payload is readable by anyone holding it, so it is worth checking that nobody stuffed an email, a phone number, or an internal ID into it. It pairs well with the habits in Docker security for self-hosting.
• 🔐 Testing signing secrets — generate a strong HMAC secret with the Secure Password and Passphrase Generator, then confirm your service signs tokens with it.

Privacy, Ads, and Data Policy

• ✅ 100% free — no registration, no account, no paywall.
• ✅ No data storage — tokens, secrets, and keys stay in your browser tab; the jwt token decoder never sends them to a server and never writes them into the URL.
• ✅ No ads in results — no watermarks, no tracking pixels, no upsells.
• ✅ Client-side only — no external API calls and no CDN dependency; signature checks use the browser’s own Web Crypto API.

Open Source and Self-Hosting

This jwt token decoder is part of the open-source vahac-tools repository on GitHub — three files in one folder, no build step, no dependencies, so you can drop it on an internal server where pasting tokens into a public site would never be allowed. Browse the rest of the collection on the Tools page, including the JSON Formatter and Validator for tidying up a payload you have copied out, and the Hash Generator for Files and Text when you need to check a digest by hand.

Built by VahaC — 100% client-side, no data sent anywhere.