JWT Decoder
Paste a compact JWT to inspect its header, payload, and signature segment, with the registered time claims translated into UTC and your local time. The token never leaves your browser.
All processing happens locally in your browser. Your input is never uploaded.
Decoding a JWT does not verify its signature or prove that the token is trustworthy. This tool only reveals what the token says about itself. Never paste production secrets, and never treat decoded claims as authenticated.
Use the synthetic example if you just want to see how the decoder works. This page never asks for signing keys or secrets.
How this JWT decoder works
The three JWT segments
A compact JWT is three Base64URL strings joined by dots: header.payload.signature. The header describes the token type and signing algorithm, the payload carries the claims, and the signature is binary data that a verifying party checks with a key. This tool decodes the header and payload to text and shows the signature segment as-is.
Base64URL decoding
JWT segments use the URL-safe Base64 alphabet (- and _ instead of + and /) and drop the trailing = padding. The decoder restores the padding, rejects characters outside the alphabet and impossible segment lengths, and reads the result strictly as UTF-8, so malformed tokens produce a clear error instead of garbled text.
Registered claims
The payload commonly carries claims registered in RFC 7519: iss (issuer), sub (subject), aud (audience), exp (expiration time), nbf (not before), iat (issued at), and jti (token ID). The time claims are NumericDate values — Unix seconds — which this tool converts to UTC and to your local time.
Reading the expiry status
The status line compares exp and nbf with your device clock: expired when exp is in the past, not active yet when nbf is in the future, currently valid by time claims when the clock sits inside the window, and no expiry claim when exp is absent. A skewed device clock shifts these results.
Decoding is not verification
Anyone can mint a token with any claims, so a decoded payload proves nothing by itself. Verifying a token means checking its signature against the issuer's key and validating the issuer, audience, and time window — a job for your authentication library on a system you trust. This page deliberately performs no signature verification and never asks for keys or secrets.
Privacy
Decoding happens in your browser after you press Decode. The token is never uploaded, logged, or stored by winterm.dev, is not placed in the page URL or browser history, and there is no analytics script on this site to see it. See the privacy policy for the website-wide details.