JWT Decoder

Read a token’s header and payload without sending it anywhere.

About JWT Decoder

A JWT decoder splits a JSON Web Token into its header, payload and signature and shows the claims as readable JSON, entirely in your browser.

How to use

  1. Paste the token. The header and payload decode as you type; nothing to click.
  2. Read the registered claims (issuer, subject, audience, issued-at, expiry) in the list, each with a Copy button. Timestamps are shown in your local time next to the raw Unix value.
  3. Check the status line: it says whether the token has expired (exp) or is not yet valid (nbf), based on your clock, and warns when the header says alg: none.
  4. Copy either part, or download the payload as JSON.

What it does and does not do

  • Decodes any token in the compact header.payload.signature form, including base64url without padding. A leading Bearer prefix is ignored, so an Authorization header value can be pasted as is.
  • Shows the signature string but does not verify it. Verification needs the issuer's secret or public key, which a browser tool should never hold. Treat the decoded claims as unverified input.
  • Works with any algorithm (HS256, RS256, ES256 and so on), since decoding does not depend on the algorithm.

Example

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxw…
→ header  { "alg": "HS256", "typ": "JWT" }
→ payload { "sub": "1234567890", "name": "John Doe", "iat": 1516239022 }

Privacy

Decoding happens with atob in the page. No request is made, and nothing is stored.

Frequently asked questions

Is it safe to paste a JWT into an online decoder?
Only if the decoder runs locally. XUtil decodes in your browser with no network request, so the token is never transmitted. A JWT is still a credential while it is valid, so avoid pasting production tokens into tools you have not checked.
Why can I read the payload without the secret?
A JWT is signed, not encrypted. The header and payload are base64url-encoded JSON that anyone can decode; the secret only lets a server verify that the signature matches. Never put sensitive data in a JWT payload.
Does this tool verify the signature?
No. It shows the signature but cannot check it, because verification requires the signing secret or public key. Use your server-side library (jsonwebtoken, jose, PyJWT) to verify.
What do iat, exp and nbf mean?
They are Unix timestamps in seconds. iat is when the token was issued, exp is when it expires, and nbf is the earliest time it is valid. The decoder converts each to a readable date.