# JWT Decoder

Canonical URL: https://offlineutils.com/jwt-decoder
Category: Developer
Published: 2026-06-24
Publisher: offlineutils.com
Runs entirely in the browser; nothing entered into the tool is uploaded.

> A JWT Decoder parses a JSON Web Token into its three Base64URL-encoded segments — header, payload, and signature — and renders the header and payload as readable JSON, all inside your browser so the token never leaves your device.

Paste a JWT to see its decoded header (algorithm, type) and payload (claims like sub, iat, exp, scope). The decoder also surfaces human-readable timestamps for iat, nbf, and exp so you can spot expired tokens at a glance. Decoding is informational only — it does not verify the signature, since verification requires the secret or public key.

## Features

- Splits a JWT into header, payload, and signature in one paste
- Renders header and payload as syntax-highlighted JSON
- Surfaces iat, nbf, and exp as human-readable timestamps with expired indicator
- Detects algorithm (HS256, RS256, ES256, none) from the header
- Token is never transmitted — decoded entirely in your browser

## Use cases

- Debugging why an API rejects a token with a generic 401
- Spotting an expired exp claim at a glance
- Inspecting the scope or roles claim while wiring up authorization
- Sanity-checking a token your auth provider just minted in staging

## How to use it

1. **Paste your JWT** — Paste the three-segment token into the input area.
2. **Read the claims** — Header and payload appear immediately as formatted JSON. Expiration is highlighted if exp is past.
3. **Compare** — Toggle the raw-Base64 view to compare segments side by side with the decoded JSON.

## When to use it, and when to use something else

- **vs jwt.io online debugger** — use JWT Decoder when the token belongs to a production user and cannot be pasted into a third-party service. Use jwt.io online debugger when you also want to verify the signature with a public key you have.
- **vs Decoding manually in the browser console** — use JWT Decoder when you want timestamps and expiration formatted for you. Use Decoding manually in the browser console when you are already in DevTools and want zero context switch.

## Frequently asked questions

### Does this verify the JWT signature?

No. Verifying a signature requires the issuer's secret key (HS256) or public key (RS256/ES256). This decoder only parses and displays the unprotected header and payload, which is what you typically need during debugging.

### Is it safe to paste a real JWT here?

Decoding happens entirely in your browser — the token is never transmitted. That said, any JWT is bearer authentication, so treat it like a password and only paste tokens you are willing to expose to the device you're on.

### Why does my JWT show as 'expired'?

If the payload contains an exp claim, we compare it to the current time. An expired exp is the most common reason an API rejects an otherwise valid-looking token.

### Can I decode a JWE (encrypted JWT)?

No. JWE tokens have five Base64URL segments and require decryption with a key. This tool decodes signed JWS tokens, which is the format the vast majority of APIs use.

## Related tools

- https://offlineutils.com/base64
- https://offlineutils.com/hash-generator
- https://offlineutils.com/json-formatter