norito / JWT Decoder

JWT Decoder

Paste a JWT to see its decoded header and payload, with standard claims like expiry explained. Nothing is uploaded, signatures are never verified or checked against a secret.

Header


        

        

          
Payload

          

        

      

    



    







    

      
How it works

      

        A JWT is three Base64URL segments joined by dots: header, payload, signature. The tool
        splits on the dots, then decodes the first two segments by mapping the URL-safe alphabet
        back to standard Base64 (- to +, _ to
        /), restoring the padding JWTs omit, running atob(), and
        decoding the bytes as UTF-8 with TextDecoder. Each segment is then
        JSON.parsed and pretty-printed. Standard claims (iss,
        sub, aud, exp, nbf, iat,
        jti) get human labels, unix timestamps become readable dates, and
        exp is compared against your clock to tell you if the token is expired. The
        third segment, the signature, is never parsed at all.
      

      

        That's the distinction this tool is strict about: decoding is not verifying. The payload
        of any JWT is readable by anyone, it's encoded, not encrypted. Proving the token is
        genuine means recomputing the signature, which requires the signing secret (for HMAC) or
        the issuer's key (for RSA/ECDSA). This tool deliberately doesn't offer a "paste your
        secret" box: getting into the habit of pasting production signing secrets into web pages
        is a risk no convenience justifies, and verification belongs on your server anyway. Never
        trust a decoded claim you haven't verified server-side.
      

      

        Everything runs in this page's JavaScript using atob and the text decoding
        APIs. Paste a real token with DevTools' Network tab open and watch: no request is made,
        the token never leaves the browser tab.
      

    









    

      
Related tools

      

        
          Base64 Encode / Decode
          Manually decode a single Base64 segment.
        
        
          Timestamp Converter
          Convert a Unix timestamp to a readable date.
        
        
          JSON Formatter
          Format the decoded payload for easier reading.
        
      

    


    
Common questions

    

      

        Does this verify the signature?
        
No, and it never will. Verifying a signature needs the secret or public key the token was signed with, and typing a signing secret into a public browser tool would be a bad security practice. This only decodes the header and payload, which is all that's needed to read what's inside a JWT.

      

      

        Is my token sent anywhere?
        
No. Decoding is just Base64URL decoding plus a JSON parse, both done entirely in your browser. Nothing about your token leaves your device.

      

      

        What does the exp claim mean?
        
Expiration time, as a Unix timestamp. This tool converts it to a readable date and tells you whether it's already passed, so you can quickly see if a token has expired.