Skip to main content

JWT Decoder

Developer Tools

Decode header/payload, inspect claims and expiry

Quick Answer

JWT Decoder: Decode header/payload, inspect claims and expiry. Three Base64URL segments: Header.Payload.Signature.

Issued at1/18/2018, 09:30:22
Expires9/22/2030, 00:37:02
AlgorithmHS256
TypeJWT

Header

{
  "alg": "HS256",
  "typ": "JWT"
}

Payload

{
  "sub": "1234567890",
  "name": "张上测试下统",
  "iat": 1516239022,
  "exp": 1916239022
}

Signature (raw)

SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

Signature verification requires the secret/key — never paste production tokens with secrets into online tools.

Decoding steps

  1. 1Split on "." into 3 segments: header / payload / signature
  2. 2Base64url-decode each segment: replace -_ → +/, restore = padding, UTF-8 decode
  3. 3JSON.parse header & payload → inspect alg / typ / claims
  4. 4exp = 1916239022 → compare with current time → pending
  5. 5Signature NOT verified here — verification needs the secret and must happen server-side

Standard claims (RFC 7519)

ClaimMeaningThis token
issIssuer—
subSubject (user id)1234567890
audAudience—
expExpiration (unix s)1916239022
iatIssued at (unix s)1516239022
nbfNot before—
jtiJWT ID (replay guard)—
JWT = base64url(header).base64url(payload).base64url(signature). The payload is only ENCODED, not encrypted — anyone can read it; never put passwords or sensitive data inside. Check `alg` isn't "none" and always verify signature + exp server-side.

Was this tool helpful?

How to Use

  1. Paste or type content: drop code/text into the JWT Decoder or fill the parameters.
  2. Choose mode/options: switch format, rules or processing as needed.
  3. Live output: results appear instantly — nothing is submitted, data stays in your browser.
  4. One-click copy: copy the output straight into your development environment.

Key Points

  • JWT Decoder is a free online developer tool — open and use, no sign-up.
  • All calculations run locally in your browser; your data never leaves the device.
  • Key capability: Decode header/payload, inspect claims and expiry.
  • Results come with formulas and reference tables so you can verify every number.

Formula & How It Works

JWT structure (JSON Web Token)

Three Base64URL segments: Header.Payload.Signature
Header: alg + typ; Payload: claims (sub/iss/exp/iat/nbf)
Timestamps are Unix seconds; expired when exp < now
Base64URL: +/ → -_, padding = dropped
Decoding ≠ verifying — never put secrets in the payload

Example: {alg: HS256} {sub: 1234} is readable by anyone holding the token.

FAQ

How do I use the JWT Decoder?
Open the page and fill in the input fields — results update automatically. Decode header/payload, inspect claims and expiry.
Are the results accurate?
Yes. Standard formulas and conversion factors are used and verified.
Is it free? Do I need to sign up?
Completely free. No registration, login or download required.
Does it work on mobile?
Yes. The responsive design works on phones, tablets and desktops.
Is my data saved?
No. Everything runs locally in your browser.

Related Tools

Related Guides

Source & Updates

Based on RFC 4648, ECMA-262 and related specifications. Last updated: 2025-07

Authoritative sources:

Last updated:

Formulas and content on this page are reviewed by the YiJianSuan team. For reference only — official sources prevail.

Maintained and periodically reviewed by the YiJianSuan editorial team — review process in ourEditorial Policy.

Cite this page: YiJianSuan. JWT Decoder[EB/OL]. https://www.yijiansuan.com/en/c/dev/jwt

Results provided by this tool are for reference only and do not constitute professional advice.