What is JWT Decoder?
The JWT Decoder reads the header and payload of a JSON Web Token so you can inspect its claims and expiry. A JWT, defined in RFC 7519, is a compact token made of three Base64URL-encoded segments — header, payload, and signature — separated by dots.
Decoding is not the same as verifying. This tool reveals what a token says, but it does not check the cryptographic signature, so it cannot prove the token is authentic or untampered. Anyone who holds a JWT can read its header and payload; the segments are encoded, not encrypted.
The tool decodes tokens entirely in your browser. Nothing is uploaded to The ToolSphere servers.
Why Use This Tool?
When debugging authentication, you often need to see exactly what claims a token carries — subject, audience, issued-at, and expiry — without wiring up code. Decoding locally lets you inspect a token quickly while keeping it off third-party servers.
- Read header and payload claims instantly.
- Check whether a token has expired via the exp claim.
- Debug auth flows without writing code.
- Keep tokens on your device while inspecting them.
How Does This Tool Work?
The tool splits the token on dots, Base64URL-decodes the first two segments, and parses them as JSON. Base64URL is the URL-safe Base64 variant from RFC 4648: it substitutes - and _ for + and /, and omits padding, which the decoder restores before decoding.
If the payload contains an exp (expiration time) claim, the tool interprets it as seconds since the Unix epoch, converts it to a date, and reports whether the current time is past that instant. The signature segment is displayed but not validated.
Understanding Your Results
The header typically identifies the signing algorithm (alg) and token type (typ). The payload contains claims: registered ones like iss, sub, aud, exp, nbf, and iat, plus any custom claims your application adds. An expiry helper flags whether exp is in the past.
A decoded token tells you what the issuer put inside it — but only signature verification against the correct key proves the token was actually issued by that party and has not been altered.
Why Tracking This Matters
Misreading a token during debugging can send you down the wrong path. Just as important, treating a decodable token as trustworthy is a security mistake: never make authorization decisions based on decoded claims without verifying the signature on your backend.
Benefits of Using JWT Decoder
- Header and payload decoding
- Base64URL padding handled automatically
- Expiry detection from the exp claim
- Clear separation of decode vs verify
- No server round-trip
- Private, in-browser processing
How Is the Result Calculated?
For expiry, the tool reads exp (seconds since 1970-01-01T00:00:00Z), multiplies by 1000 to get milliseconds, and compares against the current time. If now is greater than or equal to the expiry instant, the token is reported as expired.
expired = Date.now() ≥ exp × 1000
Tips for Better Results
- Never paste production secrets — decoding needs none, and secrets belong offline.
- Verify signatures on your backend before trusting any claim.
- Remember exp and iat are in seconds, not milliseconds.
- A token you can decode is not necessarily a token you can trust.
- Use the JWT Generator if you need to sign a test token locally.
Standards and References
Conclusion
The JWT Decoder makes it easy to inspect a token's header, payload, and expiry while keeping the token on your device.
Use it for debugging, but always verify signatures server-side — a decodable token proves nothing about authenticity on its own.