Zerdly

JWT Decoder

Decodes a JSON Web Token's base64url header and payload for inspection.

100% FreeRuns in your browserBasic
How to use this calculator

Token

Use test tokens. Never paste a production token or secret into any website.

Blank = now.

Decoded

Signature: Not verified

Paste a token to decode it.

Runs entirely in your browser. Your input is not uploaded or stored.

How the method works

Decoded does not mean verified
Illustrative method
Decoded does not mean verifiedA compact token split at its two dots into header, payload and signature. Header and payload are base64url-decoded to JSON; the signature is only bytes and stays not verified without the key.Header.base64url → JSON"alg": "HS256""typ": "JWT"Payload.base64url → JSON"sub": "1234""exp": 0Signaturebase64url → bytesraw bytesneeds the keySignature status: Not verifiedReadable claims are not trusted claims.
A compact JWS is header.payload.signature. Header and payload are base64url → UTF-8 → JSON and can be read by anyone; exp 0 means 1970-01-01T00:00:00Z. The signature can only be checked with the right key and algorithm, so the status stays “Not verified”. Five segments means an encrypted JWE, which is not decoded.

This tool never fetches keys (jku/x5u) and never shows “verified”. Fixed example values for illustration — not your result.

How to use this calculator

  1. Paste a JWT (header.payload.signature) — use test tokens, never production secrets.
  2. Read the decoded header and payload, and the exp / nbf / iat times against a reference time you can change, with optional clock skew.
  3. Copy each panel; redact the token if you print the page.

How it works

The three base64url segments are decoded as strict UTF-8 and must be JSON objects. NumericDate claims are seconds since 1970-01-01 UTC.

Five segments mean an encrypted token (JWE), whose payload cannot be read without its key. alg none is flagged as unsecured, and duplicate claim names are flagged before JSON parsing hides them.

The signature is never checked: that needs the right key on a server. The status always reads Not verified, and key URLs in the header (jku, x5u) are never fetched.

Worked example

exp: 0. Shows 1970-01-01T00:00:00Z and "expired" at a 2026 reference time. A token with no exp says the claim is absent — not that it is valid forever.

Common mistakes

  • Trusting decoded claims without verifying the signature server-side.
  • Reading exp as milliseconds — it is seconds.
  • Pasting a live production token into any website.

Tips

  • Runs entirely in your browser. Your input is not uploaded or stored.

Frequently asked questions

Does it check validity?

No — decode only. Don't trust a token's contents without verifying its signature server-side.

Is it safe to paste?

Decoding is local and nothing is stored or sent, but avoid pasting production tokens anywhere.

Related tools

Explore more in PDF, Image, File, Data & Developer Tools.

Cite this tool

Zerdly. (2026). JWT Decoder. Retrieved from https://www.zerdly.com/tools/jwt-decoder/

Tip: Enter any known values to calculate the remaining results.

Designed to run locally in your browser. Tool inputs are not intentionally stored by Zerdly unless stated otherwise.