JWT Decoder Guide
Decode JWT headers and claims locally with expiration status and optional RSA public-key signature verification.
Overview
Decode and inspect JSON Web Tokens (JWT) safely in your browser. View header parameters, payload claims, expiration timestamps, and optionally verify RSA signatures locally.
When to Use JWT Decoder
Use JWT Decoder during backend API development, authentication troubleshooting, and single sign-on (SSO) debugging to inspect token claims safely.
Inputs, Formats & Specifications
- Accepted Inputs
- Encoded JWT string (`header.payload.signature`), optional RSA public key (PEM / SPKI)
- Output Formats
- Decoded JSON Header, Decoded JSON Payload, human-readable expiration dates, signature validity status
- Supported Standards
- JWT (RFC 7519), JWS (RFC 7515); RS256, HS256, ES256 claims decoding; RS256 signature verification
- Browser Limits & Scope
- Decoding claims does not guarantee the token has not been tampered with unless signature verification is performed with the authentic public key.
How to use JWT Decoder
- Paste an encoded JSON Web Token (`eyJh...`) into the token input field.
- Inspect the Decoded Header card displaying the signing algorithm (e.g. RS256, HS256) and token type.
- Inspect the Decoded Payload card showing all claims: Issuer (`iss`), Subject (`sub`), Expiration (`exp`), Issued At (`iat`), and custom claims.
- Check human-readable timestamps indicating whether the token is currently active or expired.
- Optionally paste a public key (PEM / SPKI) to cryptographically verify the token's RSA signature locally.
Real-World Examples
Frequently Asked Questions
Does decoding a JWT expose my private secret?
No. A JWT's header and payload are simply base64url-encoded JSON, not encrypted. Decoding reads public claims without needing private keys, and all processing is local to your browser.
What does the `exp` claim mean?
The `exp` claim represents the expiration time as a UNIX epoch timestamp (seconds since January 1, 1970). Our decoder automatically converts this into local readable time and relative status (e.g. 'Expires in 42 minutes').
Does decoding verify the token's authenticity?
Decoding merely reads the claims. To verify authenticity, paste the issuer's public key to cryptographically confirm the RSA signature.
Privacy & Data Security
This jwt decoder runs in the browser, so your input stays on your device during normal use.