JWT Decoder

What is JWT Decoder?

Free JWT decoder. Decode and inspect JSON Web Token header, payload, and signature. Verify token structure and expiry without sending tokens anywhere. Developer utilities built for web developers, software engineers, and programmers. TekPulse's JWT Decoder is completely free — no signup, no ads in results, and no data stored on our servers.

How to Use JWT Decoder Online

1. Paste your JWT token (three dot-separated Base64 segments) into the input area
2. The header, payload, and signature are decoded and displayed as formatted JSON
3. Check the expiry time (exp claim) — it is converted to a human-readable date/time
4. The algorithm used (e.g. HS256, RS256) is shown from the header
5. Note: This tool only decodes the payload — it does not verify the signature (use your backend for verification)

JWT Decoder Formula & Calculation

A JSON Web Token is three Base64url-encoded segments joined by dots: a header (algorithm + token type), a payload (the claims — user data, expiry, etc.), and a signature computed over the first two segments using a secret or private key. Base64url is standard Base64 with '-'/'_' replacing '+'/'/' and padding often omitted, so URLs and headers can carry it safely.

This tool reverses the Base64url step (swap characters back, re-add padding, then atob + JSON.parse) to show you the header and payload as readable JSON. Crucially, it never checks the signature — anyone can view a token's claims this way, but that says nothing about whether the token is authentic. Signature verification requires the server's secret/public key and must happen server-side.

Key Factors That Affect Your Result

1. No signature verification here — This is a read-only inspector. A token with a tampered payload will still "decode" successfully and look valid — always verify the signature server-side with the correct secret/algorithm before trusting any claim in a JWT.
2. exp / iat / nbf claims — exp (expiry) and nbf (not-before) are Unix timestamps in seconds; a token past its exp should be rejected by the server even if the signature is valid. This tool flags expired tokens for convenience.
3. alg: none attack — A historical JWT vulnerability where setting the header's "alg" to "none" tricked poorly-implemented verifiers into skipping signature checks entirely. Always reject alg:none server-side and pin the expected algorithm.
4. Never paste production tokens into third-party tools — Even though this tool decodes entirely in the browser, treat any JWT carrying real session/user data as sensitive; decoding reveals its full payload in plain text.

Why Use TekPulse JWT Decoder?