JWT Decoder
Decode and inspect JWT tokens securely in your browser. Your tokens are never sent to a server, ensuring your sensitive authentication data remains 100% private.
Header
"alg": "HS256""typ": "JWT"
Payload
"sub": "1234567890""name": "John Doe""iat": 1516239022// 1/18/2018, 1:30:22 AM"exp": 9999999999// 11/20/2286, 5:46:39 PM
Signature
SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5cClaims summary
🔒 100% Private - Your JWT tokens never leave your browser. No server upload, no tracking, works offline. Decode and inspect any JWT (JSON Web Token) instantly with SolveBar's JWT Decoder. See the header algorithm, all payload claims, expiry status, and issued-at time in a readable format — without installing any tools or writing any code.
What is a JWT and how does it work?
A JSON Web Token consists of three Base64URL-encoded parts: header (algorithm and token type), payload (claims like user ID, expiry, roles), and signature (verification the token has not been tampered with). Anyone can decode the header and payload — only the server holding the secret key can verify the signature.
Important JWT claims explained
The exp claim is the expiry timestamp (Unix time). The iat claim is issued-at. The sub claim is the subject, usually a user ID. The iss claim is the issuer. The aud claim is the intended audience.
JWT security considerations
Never include sensitive data in JWT payloads — they are encoded, not encrypted. Always verify the signature server-side before trusting claims. Use short expiry times (15 minutes to 1 hour) for access tokens and store them in httpOnly cookies rather than localStorage to prevent XSS theft.
Frequently Asked Questions
Does this work offline?
Yes — once loaded, this tool works completely offline. Your JWT tokens are decoded entirely in your browser with JavaScript.
Is it safe to paste my JWT here?
Decoding runs entirely in your browser — no data is sent to any server. However, avoid pasting production tokens from critical systems into any online tool as a general practice.
Can this tool verify JWT signatures?
No — signature verification requires the secret key which only your server should hold. This tool decodes the readable parts (header and payload) only.
Why does my token show as expired?
The exp claim is compared against your browser's current time. If your system clock is wrong, or the token was issued with a past expiry, it will show as expired.