ZeroUtil

JWT Decoder

Decode and inspect JWT tokens — header, payload and claims.

How to Use the JWT Decoder

Paste your JSON Web Token into the input box and click "Decode" to inspect its contents. The tool splits the token into its three parts and displays each one.

What This Tool Shows

  • Header — the algorithm and token type (e.g. HS256, RS256)
  • Payload — all claims including sub, iss, exp, iat and any custom data
  • Expiration status — whether the token is expired and when it expires or was issued
  • Signature — the raw signature string and algorithm used

All decoding happens in your browser. No data is sent to any server and no verification is performed — this is a read-only inspector.

Frequently Asked Questions

What is a JWT token?

A JSON Web Token (JWT) is a compact, URL-safe token format used for securely transmitting information between parties. It has three parts: a header, a payload with claims, and a signature.

Can this tool verify the JWT signature?

No. Signature verification requires the secret key (HMAC) or public key (RSA/ECDSA) which is not available in the browser. This tool only decodes and displays the token contents.

Is it safe to paste my JWT here?

Yes. The decoding happens entirely in your browser using JavaScript. No data is sent to any server. However, you should still avoid sharing JWTs publicly as they may contain sensitive claims.

What does the expiration status mean?

If the token has an "exp" claim, the tool compares it to your current local time and shows whether the token is still valid or has expired, and how long ago or until expiration.

Why are some claims shown as timestamps?

JWT claims like exp (expiration), iat (issued at) and nbf (not before) are Unix timestamps — seconds since January 1, 1970. The tool converts them to human-readable dates automatically.

Ad

More Developer Tools