JWT Decoder
Runs 100% in your browserDecode and inspect JWT header, payload, signature, registered claims, custom claims, algorithm, timestamps, and expiry state locally without verifying or uploading the token.
Decode and inspect JSON Web Tokens
Read the header, payload, registered claims, expiry state, and signature segment locally. Decoding does not verify a signature.
JWT token
Decoding is not verification. Never paste a production token into a shared or untrusted device.
Decoded token parts
Header
algorithm and typeDecode a token to inspect the header.
Payload
claims and application dataDecode a token to inspect the payload.
Signature
base64url segmentDecode a token to inspect the signature segment.
Verify signature — locally
key never leaves this pageFor HS256/384/512 paste the shared secret. For RS/ES paste the issuer public key (PEM -----BEGIN PUBLIC KEY----- or JWK JSON). Verification runs with your browser’s Web Crypto API — the token and key are never transmitted.
Claim analysis
| Claim | Value | Meaning |
|---|---|---|
Decode a token to see registered claims such as iss, sub, aud, iat, and exp. | ||
JWT decoding happens in your browser. No token is uploaded, sent to an API, stored in localStorage, or included in analytics.
Recent inspections
Recent inspections disappear when this page closes.
Frequently asked questions
A JWT decoder splits a JSON Web Token into its header, payload, and signature segments, then decodes the Base64URL-encoded header and payload into readable JSON. It helps developers inspect claims and token metadata during debugging without verifying the signature.
Paste the complete three-part token into the decoder. ToolsSonic separates the dot-delimited segments, decodes the header and payload locally, displays the signature segment, and analyzes common registered claims such as iss, sub, aud, iat, nbf, and exp.
No. Decoding only reveals encoded data. A decoder cannot prove that a token was signed by a trusted issuer or that its claims are authentic. Your application must verify the signature with the correct key, algorithm policy, issuer, audience, and time checks.
Usually no. Standard JWTs are signed, not encrypted. Their header and payload are Base64URL encoded and can be decoded by anyone who has the token. Do not place secrets or sensitive data in a JWT payload unless you are using an appropriate encrypted-token format such as JWE.
The first part is the header, which commonly contains alg and typ. The second is the payload, which contains registered and application claims. The third is the signature segment, which is used by a verifier to check integrity and authenticity.
exp is the expiration time, iat is the issued-at time, and nbf is the not-before time. These registered claims are expressed as NumericDate Unix seconds. The decoder converts them to readable UTC dates and reports an expiry or not-active state when applicable.
The decoder can display whatever alg value appears in the header, including HS256, RS256, ES256, PS256, EdDSA, and none. Displaying an algorithm is not the same as verifying it. Your server should enforce an explicit allow-list of permitted algorithms.
Yes. The decoder can remove a leading Bearer prefix before splitting the token. It still treats the remaining token as untrusted text and performs only local decoding and inspection.
Common causes include a missing segment, extra dots, malformed Base64URL characters, invalid UTF-8 or JSON in the header or payload, copied quotation marks, or a token that includes a prefix the decoder does not recognize. A JWT must have exactly three dot-separated segments.
No. The page uses browser APIs to decode the Base64URL segments and parse JSON. It does not call a verification endpoint, upload the token, store it in localStorage, or include it in analytics. Avoid pasting live credentials on shared devices.
Yes. After decoding the payload, the tool lists every named payload property and labels registered claims separately from application-specific claims such as roles, scope, email, tenant, or permissions.
A production verifier should validate the signature with the expected key and algorithm, check the issuer, audience, expiration, not-before time, token type, and application-specific authorization rules. Never treat a decoded payload alone as proof of identity or permission.
Paste the token and the header and payload are decoded instantly in your browser using local Base64url decoding. The token never leaves your device — important, because a real JWT grants access to whatever it was issued for.
A JWT is header.payload.signature. The header names the algorithm, the payload carries the claims, and the signature lets the issuing server verify integrity. The decoder splits and displays each part.
They are timestamp claims: exp is expiry, iat is issued-at, and nbf is not-before. The decoder converts them to readable dates and tells you whether the token is currently expired.
Yes — locally. Paste the shared secret (HS256/384/512) or the issuer public key in PEM or JWK form (RS256/384/512, ES256/384/512) and click Verify. The check runs with your browser built-in Web Crypto API, so the token and the key are never transmitted anywhere. Unsigned alg:none tokens are refused with an explanation, never reported as valid.
A live token is a credential. Many online decoders send the token to their server, where it could be logged. This decoder is browser-only, which you can verify in the DevTools Network tab.
Everything runs locally in your browser with no upload, no account, and no logging. You can confirm in your browser DevTools Network tab that no request carries your data.
HS256, HS384, and HS512 with a shared secret, RS256, RS384, and RS512 with an RSA public key, and ES256, ES384, and ES512 with an EC public key. Keys are accepted as SPKI PEM blocks or JWK JSON. PS* and EdDSA are not supported yet and the tool says so rather than guessing.
What is JWT Decoder?
A JWT decoder is a developer tool for inspecting a JSON Web Token without treating its encoded contents as proof of identity. It splits a token into the header, payload, and signature segments, decodes the Base64URL-encoded JSON, and presents registered claims such as issuer, subject, audience, issued time, not-before time, and expiration in a readable format.
ToolsSonic's JWT Decoder goes beyond simply pretty-printing a token. It validates that the input has exactly three dot-separated segments, strips an optional Bearer prefix, decodes both header and payload using native browser UTF-8 APIs, builds a structured claim analysis table that labels registered claims (iss, sub, aud, exp, nbf, iat, jti) separately from custom claims like roles, scope, email, and permissions, converts NumericDate timestamps to UTC dates with relative durations ("expires in 2h 14m" or "expired 3 days ago"), and shows a visible warning when the header declares alg: none — an unsigned token that many libraries incorrectly accept.
Security boundary: Decoding a JWT is not the same as verifying it. A decoded payload shows what claims the token asserts, but your application must still verify the signature with the correct algorithm, key, issuer, and audience before trusting those claims for authentication or authorization.
Common use cases
- Debugging OAuth and OpenID Connect authentication flows during development
- Inspecting JWT access-token and ID-token claims from Auth0, Okta, Azure AD, or Cognito
- Checking exp, iat, and nbf timestamps when tokens are rejected as expired
- Reading roles, scopes, tenant IDs, and custom identity claims
- Confirming the declared signing algorithm before server-side verification
- Explaining why a three-part token fails to parse due to encoding or format issues
Why use ToolsSonic's JWT Decoder?
ToolsSonic's JWT Decoder is a jwt.io alternative that keeps the full token in the browser and never calls a verification endpoint or uploads the token. It provides a three-panel Header/Payload/Signature layout, a structured claims table with human-readable meanings for every registered claim, NumericDate-to-UTC conversion with relative time, expiry and not-before state detection, an alg: none warning, payload copy, report download, and memory-only session history. It is explicit about the decode vs. verify distinction — making it safer for developers to use during debugging without misunderstanding what decoding proves.
Related tools
Base64 Decode
Decode standard or URL-safe Base64 back to UTF-8 text locally. Handles Data URI prefixes, whitespace, missing padding, strict validation, malformed input errors, and readable output statistics.
Unix Timestamp Converter
Editor's choiceConvert Unix timestamps and epoch time to readable UTC or local dates, or turn ISO/date-time strings into seconds, milliseconds, microseconds, and nanoseconds. Includes timezone, relative time, difference, and developer outputs.
JSON Formatter
Editor's choiceFormat, beautify, minify, and validate JSON locally. Choose indentation, sort keys, preserve Unicode, inspect statistics, and copy or download clean output.
JSON Validator
Editor's choiceValidate JSON online with precise line and column diagnostics, targeted repair hints, structure inspection, and browser-only processing — no upload, no account.
SHA-256 Generator
Editor's choiceGenerate SHA-256 hashes for text or local files, compare five digest algorithms, verify checksums, and export results entirely in your browser.