JWT Decoder

How JWT Decoder works

Inspect the header and payload of any JWT and see its expiry status. Decoding only — the signature is not verified. Everything happens inside this page: the tool reads your input, runs the calculation or conversion locally, and hands the result back to you. Nothing is transmitted, because there is no backend to transmit it to.

That design choice is deliberate. Most free tool sites upload your files to a server, process them there, and quietly keep a copy. Toolcin cannot do that — the site is a set of static files. If your connection dropped the moment the page finished loading, every tool would still work.

Three parts, two of them readable

A JWT is header.payload.signature, each Base64URL encoded. The tool decodes the header and the payload and prints them as JSON; the signature stays as-is, because verifying it needs the secret or public key, which this page does not have.

Base64URL swaps + and / for - and _, and drops padding. The decoder handles that conversion and re-pads before decoding, which is why a token pasted straight from an Authorization header works without editing.

What the claims mean

Standard claims are short and easy to misread. exp is an expiry timestamp in seconds, iat is issued-at, nbf is not-before, and aud is the intended audience. A token with no exp never expires, which is a finding in itself.

Custom claims are whatever the issuer decided, so treat them as data rather than as documented fields.

Decoding is not verifying

Anyone can decode a JWT; that is by design. Never treat a decoded payload as trusted input until the signature has been verified server-side, and never make an authorisation decision in the browser based on what the payload says.

Pasting a production token into a web page is a bad habit even when the page is honest — a token in a URL, a browser extension or a shared screen is a token leaked. Use test tokens here.

Good to know

• Works offline once loaded, including on flights and in locked-down networks.
• No file size limit beyond your device's own memory.
• Free to use, with no account and no usage counter.
• Results are produced locally, so they are not logged or shared with anyone.

Questions