JWT Decoder

What this JWT decoder does

A JSON Web Token usually contains three dot-separated parts: a header, a payload and a signature. This tool decodes the header and payload so you can inspect claims such as issuer, audience, subject and expiration. It does not verify the signature, and decoding a token must never be treated as proof that the token is valid.

Header, payload and signature

The header describes the token type and algorithm. The payload contains claims, often including iss for issuer, aud for audience, sub for subject, iat for issued-at time and exp for expiration. The signature is a cryptographic check created by the issuer. This page can show what the token says; only the system with the correct key can decide whether it should be trusted.

How to use it responsibly

Paste only tokens from development, staging or throwaway sessions.
Decode the token and inspect the claims.
Check whether exp is in the past.
Confirm the expected issuer and audience in your actual application code.
Use a JWT library and the issuer public key or shared secret for real verification.

Common mistakes

Assuming decoded means verified.
Pasting active production bearer tokens into online tools.
Trusting the algorithm field without enforcing allowed algorithms server-side.
Ignoring audience checks when a token was issued for a different service.

Browser-only processing

JWT Decoder runs as plain JavaScript inside this page using the browser's own Web Crypto and text APIs where the tool needs randomness or hashing. There is no request to our server when you press the tool buttons, so nothing you enter leaves your device through EmailGenerator.pro.

Privacy note

No input is sent anywhere by the tool. It operates entirely in your browser tab. You can verify this by opening the browser's network inspector and running the tool: execution does not create an outbound request.

Questions

Does this verify JWT signatures?

No. It decodes the header and payload only. Signature verification requires the issuer key and must happen in trusted application code.

Can I paste a real access token here?

Avoid pasting active production tokens into any online page. Use development tokens or revoke the token after inspection.

What does exp mean?

The exp claim is a Unix timestamp that says when the token should expire. The tool displays it as an ISO date when present.