Supported input
Paste the complete compact token containing header, payload and signature sections.
Start typing to search 227 tools.
Encode & Decode
Ready
JWT Decoder
Decode JWT header and payload online, inspect alg/type and time claims, and see expiration status without pretending to verify the signature.
Decode JWT header and payload JSON Show alg and typ values Convert iat, nbf and exp claims to UTC Show expiration/not-before status without signature verification
Tips
Decoded claims remain untrusted until another system verifies the signature.
Decoding a JWT does not prove authenticity. Header and payload claims remain untrusted until the signature, issuer and audience are verified by your application.
Private browser processing. Your input is processed on this device and is not sent to the Trexmi server.
INPUT JWT token to inspect *
Paste the complete compact token containing header, payload and signature sections. Example: eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ1c2VyLTQyIn0.signature
Decoded JWT
Decoded header, payload and claim timing summary. Signature verification is not performed.
About the tool
What JWT Decoder does
JWT Decoder reads the three sections of a compact JSON Web Token and decodes the Base64URL header and payload into readable JSON. It also summarizes the declared algorithm, token type, signature-section presence and common time claims such as iat, nbf and exp.
Decoding is not verification. A forged JWT can contain perfectly readable claims. Do not trust identity, role, issuer, audience or expiration decisions until your application verifies the token signature and validates the expected claims.
How to use
- Paste the full token. A compact JWT normally contains header, payload and signature sections separated by dots.
- Decode. The first two Base64URL sections must decode to valid JSON.
- Inspect the header. Review
alg,typand any key identifiers. - Inspect claims. Review subject, issuer, audience and application-specific values.
- Check timing. Trexmi converts numeric
iat,nbfandexpvalues to UTC. - Verify elsewhere. Signature and trust checks require the correct key and application policy.
Built for the task
Why use JWT Decoder?
Focused controls, predictable output, and a workflow designed around this exact transformation.
01
Header and payload
Both readable JSON sections are displayed separately.
02
Time-claim summary
iat, nbf and exp values are converted to human-readable UTC timestamps.
03
Status hint
Expiration/not-before status is summarized from claims without presenting it as signature verification.
04
Explicit trust boundary
The tool clearly states that authenticity, issuer and audience are not verified.
Useful answers
Questions about JWT Decoder
Practical details about input, output, privacy, limits, and the best way to use this tool.
01 Does JWT Decoder verify the signature?
No. It only decodes the token. Signature verification requires the correct secret or public key and the expected algorithm.
02 Can I trust an ACTIVE status?
No. ACTIVE only describes the decoded time claims. A forged token can contain any expiration value.
03 What are exp, nbf and iat?
exp is expiration time, nbf is not-before time, and iat is issued-at time. They are commonly NumericDate values in Unix seconds.
04 Why can a JWT be decoded without a key?
The header and payload are Base64URL encoded, not encrypted. The key is needed to verify a signature, not to read those sections.
05 Should I paste a production access token?
Avoid exposing active credentials. Use expired, redacted or test tokens whenever possible.
Learn JWT
Read the complete JWT Guide
Understand JWT headers, payloads, claims, signatures, verification, expiration, refresh flows, and security practices.
- Header, payload, and signature
- Claims and verification
- Expiration and token security
Read guide
Practical explanations and examples
Examples
Decode subject and role
The token is readable, but the displayed role is still untrusted.
JWT input
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyLTQyIiwicm9sZSI6ImVkaXRvciJ9.demo_signature
Decoded claims
Header: {"alg":"HS256","typ":"JWT"}
Payload: {"sub":"user-42","role":"editor"}
Status: NO EXP CLAIM
Signature: not verified
Inspect an expired token
Expiration is calculated from the claim without authenticating the token.
JWT input
eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL2F1dGguZXhhbXBsZS5jb20iLCJhdWQiOiJ0cmV4bWktYXBpIiwiZXhwIjoxNzA0MDY3MjAwfQ.demo_signature
Decoded claims
Algorithm: RS256 Issuer: https://auth.example.com Audience: trexmi-api exp: 2024-01-01T00:00:00Z Status: EXPIRED Signature: not verified
Show an empty signature section
Readable claims never prove authorization.
JWT input
eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJuYW1lIjoiQWRhIiwiYWRtaW4iOnRydWV9.
Decoded claims
Header alg: none
Payload: {"name":"Ada","admin":true}
Signature section: Empty
Trust: not verified
What a JWT decoder can and cannot prove
A decoder reveals the JSON header and payload declared by a compact token. It can show alg, typ, identity claims, roles, issuer, audience, and numeric time claims. It cannot prove who created the JWT, whether its signature is valid, or whether the issuer and audience match application policy.
The status label is only a calculation from untrusted exp and nbf numbers. Signature verification with the expected key and algorithm must happen before authorization.
JWT decoding examples
Decode subject and role claims
Token:
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyLTQyIiwicm9sZSI6ImVkaXRvciJ9.demo_signature
Header: {"alg":"HS256","typ":"JWT"}
Payload: {"sub":"user-42","role":"editor"}
Status: NO EXP CLAIMInspect an expired exp claim
Token:
eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL2F1dGguZXhhbXBsZS5jb20iLCJhdWQiOiJ0cmV4bWktYXBpIiwiZXhwIjoxNzA0MDY3MjAwfQ.demo_signature
Algorithm: RS256
Issuer: https://auth.example.com
Audience: trexmi-api
exp: 1704067200 = 2024-01-01T00:00:00Z
Status: EXPIREDDecode a token with an empty signature section
Token:
eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJuYW1lIjoiQWRhIiwiYWRtaW4iOnRydWV9.
Header alg: none
Payload: {"name":"Ada","admin":true}
Signature section: Empty
Trust: not verifiedexp, nbf, and iat time claims
JWT NumericDate values are Unix seconds. iat states when a token claims it was issued, nbf states when it may become active, and exp states when it expires. Convert an individual value with Timestamp Converter when you need several date formats or a local timezone.
Clock skew and application-specific leeway can change the acceptance window. The decoder does not apply the same policy as every identity provider.
Malformed sections and JSON errors
A compact JWT must contain exactly three dot-separated sections, and the first two must be canonical Base64URL values that decode to valid UTF-8 JSON. Standard Base64 uses a different alphabet; Base64 Decoder is appropriate only for standard Base64 data, not direct JWT sections containing - or _.
Use JSON Validator for copied header or payload JSON and JSON Formatter to reformat a large decoded object. Never paste an active access token when a synthetic or expired example is sufficient.
Reference
JSON Web Token is defined by RFC 7519.