JWT Decoder
Decode a JSON Web Token’s header and payload instantly — expiration, algorithm, and unsigned-token warnings included.
Decoded locally in your browser — nothing is sent to a server.
JWT input
1 lines155 charsValid
alg: HS256This tool only decodes — it never verifies the signature (that requires the issuer’s secret/public key).
Header
Payload
Issued at: 1/18/2018, 1:30:22 AM UTC
Signature (raw, not verified)
About this tool
Paste or upload a JWT to decode its header and payload as readable JSON, with the declared algorithm, an unsigned-token warning when applicable, and the standard exp/iat/nbf timestamp claims converted to UTC. This is a decoder, not a validator — it never checks the signature.
Frequently asked questions
- Does this tool verify the JWT's signature?
- No, and it never will. Verifying a signature requires the issuer's secret (for HMAC algorithms like HS256) or public key (for RSA/ECDSA algorithms), neither of which should ever be pasted into a browser tool. This tool only decodes the header and payload for inspection — always verify signatures server-side, with the key material kept secret.
- Is my token sent to your servers?
- No. Decoding happens entirely in your browser. Nothing you paste, upload, or generate here is sent to WebCodeIn's servers, logged, or stored — this matters more for a JWT than most inputs, since a real token can grant access to whatever issued it.
- What does the "Unsigned token" warning mean?
- It appears when the header's alg claim is "none", which means the token has no signature at all and can be trivially forged by anyone. Legitimate tokens almost always use a real algorithm like HS256 or RS256.
- What do the Expires/Issued at/Not valid before badges mean?
- They're the standard exp, iat, and nbf claims (RFC 7519), which are Unix timestamps in seconds. This tool converts them to UTC (a fixed timezone, shown consistently regardless of yours) and flags exp as expired if it's in the past — using your browser's clock, not a server's.
Privacy
Every decode operation runs in your browser. No token, request, or decoded value is sent to WebCodeIn’s servers, logged, or stored.
Related tools
Environment Variable ConverterJSON FormatterYAML FormatterJSON ↔ YAML ConverterBase64 Encoder/DecoderURL Encoder/DecoderCron Expression GeneratorRegex TesterA1Z26 Cipher DecoderBinary Code TranslatorCaesar Cipher ToolHex to Text ConverterMD5 Hash GeneratorMorse Code TranslatorROT13 Encoder/DecoderUTF-8 Encoder/DecoderNumber SorterUTM GeneratorJSON Stringify TextJSON UnstringifierNATO Phonetic Alphabet TranslatorWingdings Translator & ConvertercamelCase ConverterPascalCase Convertersnake_case Converterkebab-case Converterdot.case ConverterSlugify URL GeneratorCSS FormatterSCSS FormatterHTML Formatter, Minifier & BeautifierJavaScript FormatterTypeScript FormatterXML FormatterGraphQL FormatterMarkdown FormatterCSV to JSON ConverterMarkdown Table GeneratorHTML to Markdown ConverterWord to Markdown ConverterPDF to Markdown ConverterQR Code Generator