JWT Decoder

JWT Decoder

Decode JSON Web Tokens to inspect their contents without needing the signing secret. Useful for debugging auth flows, checking token expiration, and understanding token claims.

Capabilities

• Decode JWT: Split a token into header, payload, and signature. Parse all standard claims (iss, sub, aud, exp, nbf, iat, jti).
• Expiration check: Determine if a token is expired, when it expires, and how much time remains.
• Header inspection: View algorithm, token type, and key ID (kid) from the JOSE header.
• Claim analysis: List all claims with human-readable labels for registered claim names.

Gotchas

• No signature verification: This tool decodes tokens but does NOT verify signatures. It cannot tell you if a token is authentic — only what it contains.
• JWE (encrypted tokens): Not supported. Only JWS (signed) tokens with base64url-encoded payloads.
• Nested JWTs: If the payload contains another JWT, it is returned as a string — not recursively decoded.