JWT Decoder
Decode JSON Web Tokens instantly. View header, payload, and signature with syntax highlighting, expiration checks, and claims analysis — all in your browser.
Paste a JWT token above and click Decode
or click Sample to try with an example token
About JWT Decoder
A JSON Web Token (JWT) is a compact, URL-safe string made of three Base64url-encoded segments separated by dots: a JOSE header that declares the signing algorithm (for example HS256 or RS256), a claims payload that carries the actual data (user ID, roles, expiry, issuer, and any custom fields), and a cryptographic signature that proves the token has not been tampered with. JWTs are the dominant credential format in modern REST APIs, OAuth 2.0 / OpenID Connect flows, and single sign-on systems because a server can validate them without a database round-trip.
This JWT Decoder lets you inspect the full contents of any token in seconds. Paste a raw JWT and click Decode: the tool splits the three segments, Base64url-decodes the header and payload into syntax-highlighted JSON, converts every Unix timestamp (iat, exp, nbf) into a human-readable date in your local timezone, explains each standard registered claim (iss, sub, aud, exp, nbf, iat, jti) inline, and shows a live expiration status banner that tells you exactly how much time is left — or how long ago the token expired. The raw Base64url signature is displayed alongside the algorithm label from the header.
Everything runs entirely inside your browser. Your token is never sent over the network, never logged, and never stored — which matters especially when you are debugging tokens that carry real user IDs, session data, or access scopes. There is no account required, no file size limit, and no cost. If you need to compare a token against its original claims set, or simply want to understand what an authorization server is issuing, this tool gives you the complete picture without exposing your credentials to a third-party server.
Key Features
Three-panel decoded view
Header, payload, and signature are separated into clearly labelled panels with distinct colour coding so you can find any field at a glance.
Live expiration countdown
A status banner reads the exp claim and tells you exactly how long until the token expires, or how long ago it expired — updated to the minute.
Human-readable timestamps
Unix epoch values for iat, exp, and nbf are automatically converted to your local date and time, eliminating the need for a separate epoch converter.
Inline standard-claims guide
Registered claims such as iss, sub, aud, and jti are annotated with plain-English descriptions drawn directly from the RFC 7519 specification.
Syntax-highlighted JSON
Keys, strings, numbers, booleans, and null values are colour-coded in the output so nested claim structures are easy to read without formatting manually.
Fully client-side and private
Decoding happens in your browser with no network requests. Tokens containing real user data, session secrets, or access scopes never leave your machine.
How to Use
Paste Your Token
Copy a JWT from your application, API response, or authorization header and paste it into the input field.
Click Decode
Hit the "Decode" button to split and Base64url-decode the token into its header, payload, and signature components.
Review Results
Inspect the decoded JSON with syntax highlighting, check expiration status, and review standard claims with their descriptions.
Example
A real HS256 token is split into its three segments. The header reveals the algorithm, the payload exposes all claims with timestamps decoded to readable dates, and the raw signature is shown with a note that validation requires the issuer key.
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyLCJleHAiOjE5MTYyMzkwMjIsImlzcyI6Imhhenl1LnRvb2xzIiwiYXVkIjoiaHR0cHM6Ly9oYXp1dS50b29scyIsImp0aSI6ImFiYzEyMyJ9.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5cHEADER
{
"alg": "HS256",
"typ": "JWT"
}
PAYLOAD
{
"sub": "1234567890",
"name": "John Doe",
"iat": 1516239022, → Mon, Jan 18 2018 02:30:22 (Issued At)
"exp": 1916239022, → Tue, Jan 18 2031 02:30:22 (Expires At)
"iss": "hazuu.tools",
"aud": "https://hazuu.tools",
"jti": "abc123"
}
SIGNATURE (Base64url — HS256)
SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5cCommon Use Cases
- arrow_circle_right
Debugging authentication failures
When an API returns 401 Unauthorized, paste the bearer token to check whether the exp claim has passed, whether the aud matches the expected audience, or whether the sub is correct — without touching the server.
- arrow_circle_right
Auditing third-party tokens in OAuth flows
Inspect ID tokens and access tokens returned by identity providers such as Auth0, Cognito, or Google to confirm the scopes, roles, and issuer before wiring them into your application logic.
- arrow_circle_right
Understanding token structure during development
When building a new API that issues JWTs, verify that your signing library encodes the algorithm, expiry, and custom claims exactly as specified — catching mismatches before they reach production.
- arrow_circle_right
Reading timestamp claims without a converter
The iat and exp fields are Unix epoch integers. This decoder converts them to your local date and time inline, so you can confirm token lifetimes without a separate epoch tool — unlike the sibling JSON Formatter, which only pretty-prints raw JSON.
- arrow_circle_right
Security reviews and penetration testing
During a code review or pentest, quickly inspect tokens captured from HTTP traffic to check for missing expiry claims, overly broad audience values, or use of weak algorithms like none or HS256 on public endpoints.