JWT Decoder

Purpose

JWT (JSON Web Token) decoder that splits xxxxx.yyyyy.zzzzz into Header, Payload, and Signature parts, Base64URL-decodes Header and Payload, and shows claims in a readable view. Supports HS256, HS384, HS512, RS256, ES256 signature algorithms with optional signature verification (secret or public key). Recognizes standard claims (iss, sub, aud, exp, iat, nbf, jti) and auto-detects expired tokens. All parsing happens locally; sensitive tokens never leave the browser.

Steps

1. Paste the full JWT token (eyJhbGc...xxxxx.yyyyy.zzzzz)
2. The tool splits the three segments and Base64URL-decodes Header and Payload
3. Left pane: Header — alg (algorithm) and typ (usually JWT)
4. Right pane: Payload — standard claims highlighted (exp, iat, iss, sub, aud)
5. Expired tokens are flagged with a warning
6. Optional Verify Signature: HS256 takes a secret string, RS256/ES256 takes a public key in PEM format
7. Copy Header / Payload JSON separately
8. Reverse: edit Payload then sign a new token (with secret or private key)

FAQ

Is JWT encrypted? Can I put sensitive info in the payload?

JWT is signed, not encrypted by default. The payload is just Base64URL-encoded — anyone can decode it. Never put passwords, ID numbers, or banking info in the payload. For encryption use JWE (JSON Web Encryption), not plain JWT.

What is the format of JWT exp? Seconds or milliseconds?

JWT spec uses Unix timestamp in seconds (10 digits). 13-digit values are a backend bug. The tool converts exp to a readable date so you can verify. Common token lifetime: 1 hour (exp = iat + 3600).

When to use HS256 vs RS256?

HS256 is HMAC-SHA256, symmetric: same secret for issuing and verifying. Fast but the secret cannot leak. RS256 is RSA-SHA256, asymmetric: private key issues, public key verifies. Use HS256 for monoliths, RS256 for microservices (verifiers only need the public key).

Verification fails but the token looks correct. What to check?

Common causes: 1) wrong secret (whitespace, case sensitivity); 2) algorithm mismatch (HS256 vs RS256); 3) payload was modified after signing; 4) clock skew making exp fail (NTP issue); 5) RSA public key format wrong (PKCS#1 vs PKCS#8, PEM encoding errors).

How do I revoke a JWT? How to invalidate before expiry?

JWT is stateless by design — no native revocation. Common approaches: 1) short expiry (15 minutes) + refresh tokens; 2) a server-side jti blocklist (breaks statelessness); 3) issue new tokens on password change and rotate the secret to invalidate all old tokens. Production usually combines these.

Use cases

• Login flow debugging: decode the token to see if claims are correct or missing
• Authorization bug triage: user reports 401; decode their token to check exp, permissions
• Frontend-backend integration: iterate on payload field names by repeated encode-decode
• Security review: ensure tokens do not carry sensitive data
• API doc examples: decode the example token to show readers what claims mean

Use cases

Login debugging, authorization bug triage, frontend-backend integration, security review, API doc examples. Backend, frontend, security engineers, QA. Three-segment visualization, standard-claim recognition, expiry detection, and optional signature verification are the differentiators. Sensitive tokens decoded here never leave the browser.