TextGround TextGround

JWT Decoder

Paste a JWT token to instantly inspect its header, payload claims, and expiry. All decoding happens in your browser — your token never leaves this tab.
Header 

      

    


    
    

      

        Payload
        
      

      

        

          
        

        

        

      

    


    
    

      

        Signature
        
      

      

        
 Not verified — provide your HMAC secret above and click Decode to verify

        

        

          
        

      

    


  


  
 Your token is decoded locally — nothing leaves this browser tab. No tokens, secrets, or claims are logged, stored, or transmitted.







  
 About the JWT Decoder

  
JSON Web Tokens (JWTs) are a compact, URL-safe way to represent claims between two parties. They are widely used in OAuth 2.0, OpenID Connect, and many REST APIs as Bearer tokens. This tool decodes the Base64url-encoded header and payload segments, formats them as readable JSON, and highlights time-sensitive claims like exp (expiry), iat (issued at), and nbf (not before). For HMAC-signed tokens (HS256, HS384, HS512) you can optionally enter your secret to verify the signature using the browser's built-in WebCrypto API — the secret never leaves your device.

  
Unlike sending tokens to a third-party server, everything here runs in JavaScript inside your browser tab. This is especially important when debugging tokens that carry sensitive user or business data.


  
 Frequently Asked Questions


  

    
    

      A JSON Web Token is three Base64url-encoded segments joined by dots: header.payload.signature. The header declares the algorithm (e.g. HS256, RS256) and token type. The payload contains "claims" — JSON fields such as sub (subject), exp (expiry), iss (issuer), and any custom data. The signature ties the two together and proves the token has not been tampered with (when verified with the correct key).
    

  


  

    
    

      All decoding happens in your browser using JavaScript. No data is sent to any server — you can even disconnect from the internet and the tool will still work. That said, treat JWTs like passwords: revoke them if you believe they have been compromised. If in doubt, rotate the token after debugging.
    

  


  

    
    

      For HS256, HS384, and HS512 tokens, the signature is HMAC-SHA(header_b64 + "." + payload_b64, secret). This tool re-computes that MAC using the WebCrypto API (SubtleCrypto.sign), then compares the result to the signature segment embedded in the token. If they match, the token was signed with that secret and has not been modified. RS256/ES256 (asymmetric) verification requires the public key and is not currently supported.
    

  


  

    
    

      A JWT with "alg":"none" in its header has no signature — any server that accepts it without validating the algorithm claim is vulnerable to forged tokens. An attacker can craft arbitrary payloads and pass them unsigned. Most JWT libraries should reject alg:none by default; if yours doesn't, you have a critical security misconfiguration.
    

  


  

    
    

      These are standard registered claim names defined in RFC 7519. exp (Expiration Time) is a Unix timestamp after which the token must not be accepted. iat (Issued At) records when the token was minted. nbf (Not Before) is a Unix timestamp before which the token is not yet valid. All three are in seconds since the Unix epoch (1970-01-01T00:00:00Z).
    

  


  

    
    

      Base64url differs from standard Base64: it uses - instead of + and _ instead of /, and padding (=) is often omitted. If your token was copy-pasted with line breaks, extra spaces, or URL-encoding artifacts (e.g. %2B), the decoder may fail. Try trimming whitespace and URL-decoding the token first.