Decode and inspect JSON Web Tokens. View header, payload, and signature. Detects expiry and maps all registered JWT claims.
A JWT is not encrypted. It is 3 base64url segments joined by dots, and anyone holding one can read every claim inside it without a key or a password. The JWT Decoder makes that concrete: paste a token and the header and payload appear as formatted JSON, alongside the signature and an expiry verdict.
Decoding re-interprets the raw bytes as UTF-8 before parsing, which sounds pedantic until a claim holds a name like José. The naive approach reads each byte as a Latin-1 character and hands José to the parser, and because that is still valid JSON nothing errors and the corruption goes unnoticed.
Under the two JSON blocks sits a Registered Claim Summary that names the 7 standard claims present in your token, translating iss, sub, aud, exp, nbf, iat and jtiinto English and rendering the three timestamp claims as real dates. The token stays in the page throughout.
Press Load sample. The Header block returns {"alg": "HS256", "typ": "JWT"} and the payload carries a subject of 1234567890, a name, an iat of 1516239022 and an exp of 9999999999. The claim summary renders those two epochs as January 2018 and November 2286, which is why the badge above reads Token is NOT expired. That sample is the canonical one from the JWT specification, so its signature is genuinely valid for the secret the spec publishes.
admin, and it will decode here exactly as cleanly as a real one.exp and still be revoked, replayed or issued by the wrong party.exp gets no badge at all, because absence of an expiry is not the same as being valid, and it is worth noticing on its own.A JWT must have exactly 3 parts separated by dots. Truncated copy and paste is the usual culprit; encrypted JWE tokens have 5 parts and will not decode here either.