JWT Decoder & Token Inspector
Decode, validate, and inspect JSON Web Tokens (JWT) in real-time. View header algorithms, payload claims, and expiration timestamps with zero server tracking.
Paste Encoded JSON Web Token
How to Decode a JWT Token
- Paste Your Token: Paste your compact encoded JWT string into the input box or click Load Sample Token to view a demonstration.
- Examine Decoded JSON: Review the three color-coded segments: red for Header (algorithm & key id), purple for Payload (user attributes & claims), and the cryptographic signature.
- Verify Expiration & Claims: Check the automatic expiration indicator to confirm whether the token is currently valid or expired, and inspect registered claim timestamps.
Standard Registered JWT Claims (RFC 7519)
The Internet Engineering Task Force (IETF) defines standard claim names to facilitate interoperability across authentication systems:
| Claim | Full Name | Data Type | Purpose & Standard Definition |
|---|---|---|---|
| iss | Issuer | String / URI | Identifies the principal that issued the JWT (e.g. https://auth.company.com) |
| sub | Subject | String / UUID | Identifies the subject of the JWT (e.g. user_id: 12345) |
| aud | Audience | String / Array | Identifies the recipients that the JWT is intended for (e.g. api.service.com) |
| exp | Expiration Time | NumericDate (Unix) | Identifies the exact expiration timestamp after which the token must be rejected |
| nbf | Not Before | NumericDate (Unix) | Identifies the time before which the token must not be accepted |
| iat | Issued At | NumericDate (Unix) | Identifies the time at which the JWT was issued |
| jti | JWT ID | String | Provides a unique identifier for the token to prevent replay attacks |
Frequently Asked Questions
Can anyone read the payload data inside a JWT without the private key or secret?▼
Yes! A standard JWT is signed and Base64URL-encoded, not encrypted. Anyone who intercepts the token string can decode the header and payload instantly using tools like this. For this reason, never place private passwords, unhashed social security numbers, or sensitive financial data inside standard JWT claims.
Is it safe to paste real tokens into this online decoder?▼
Yes. CalcMaster’s JWT decoder executes 100% client-side in your local browser window. Unlike other online tools that make background HTTP requests or log telemetry, your token is parsed strictly in your browser's RAM and is never transmitted over the network.
How do I check if my JWT token has expired?▼
Our decoder automatically reads the 'exp' claim in your payload, compares it with your computer's local clock, and displays an active status badge showing either the remaining time until expiration or how many minutes ago it expired.
What is the difference between JWS (Signed) and JWE (Encrypted)?▼
A JWS (JSON Web Signature) has three parts (Header.Payload.Signature) where the payload is readable Base64URL text accompanied by a cryptographic signature. A JWE (JSON Web Encryption) has five parts and encrypts the payload ciphertext so only the private key holder can read its contents.
Which signature algorithms are most commonly used in JWTs?▼
The most common symmetric algorithm is HMAC SHA-256 (HS256), which uses a shared secret. Modern enterprise and OAuth2/OIDC systems typically use asymmetric algorithms such as RS256 (RSA Signature with SHA-256) or ES256 (ECDSA using P-256 and SHA-256).
Can this decoder verify the token's cryptographic signature?▼
This tool inspects the token structure, algorithm, and payload. While signature verification requires providing the secret or public certificate, decoding the payload is purely mathematical Base64URL unpacking and does not require keys.
What does the 'alg': 'none' vulnerability mean?▼
Some early JWT libraries erroneously accepted tokens with alg set to 'none', allowing attackers to forge arbitrary administrative claims without a valid signature. Modern backends reject tokens with 'none' algorithms.
Client-Side Guarantee
- ✓100% In-Browser parsing: tokens never touch our servers.
- ✓Automated Unix timestamp conversion to local time.
- ✓Zero telemetry or clipboard monitoring.