JWT Decoder

Paste a JSON Web Token to see the header, the formatted payload and the issued-at and expiry dates in your time zone, plus whether the token is still valid.

JWT token

The signature is not verified: decoding happens in your browser and no key is requested.

Header

{
  "alg": "HS256",
  "typ": "JWT"
}

Payload

{
  "sub": "1234567890",
  "name": "NT Tools",
  "iat": 1700000000,
  "exp": 4102444800
}

Use via API

Decodes a JWT header and payload and resolves the claim dates. The signature is not verified.

POSThttps://enhanced.dev.br/api/v1/jwt/decode
JSON body parameters
Body (JSON)TypeDescription
token *stringJWT; the "Bearer " prefix is accepted.

Request example

curl -X POST "https://enhanced.dev.br/api/v1/jwt/decode" \
    -H "Content-Type: application/json" \
    -d '{"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjMiLCJpYXQiOjE3MDAwMDAwMDAsImV4cCI6NDEwMjQ0NDgwMH0.signature"}'

Response

{
  "ok": true,
  "data": {
    "header": {
      "alg": "HS256",
      "typ": "JWT"
    },
    "payload": {
      "sub": "123",
      "iat": 1700000000,
      "exp": 4102444800
    },
    "signature": "signature",
    "issuedAt": "2023-11-14T22:13:20.000Z",
    "notBefore": null,
    "expiresAt": "2100-01-01T00:00:00.000Z",
    "expired": false,
    "signatureVerified": false
  },
  "meta": {
    "version": "v1"
  }
}
  • Errors return { ok: false, error: { code, message } } with an HTTP 4xx/5xx status.
  • Free, no API key required. Limited to 120 requests per minute per IP.
  • CORS enabled: call it straight from the browser on any domain.

How to use

  1. Paste the token into the field (a Bearer prefix is removed automatically).
  2. Review the decoded header (algorithm and type) and payload as JSON.
  3. Check the status: valid, expired or not yet active (nbf).
  4. Look at the iat, nbf and exp time claims converted to local dates.

Use cases

  • Finding out why an API returns 401: expired token or wrong audience.
  • Checking the scopes, roles and tenant issued by your identity provider.
  • Debugging OAuth 2.0 and OpenID Connect integrations (id_token, access_token).
  • Verifying the signing algorithm advertised in the header.

Technical concepts

JWT structure

A JWT (RFC 7519) has three Base64URL parts separated by dots: header, payload and signature. Header and payload are plain JSON; the signature is computed over the first two segments with the algorithm named in alg, such as HS256 or RS256.

Registered claims

iss identifies the issuer, sub the subject, aud the audience, exp the expiry time, nbf the time from which it is valid and iat the issue time. Dates are NumericDate values: seconds since 1970-01-01 UTC.

Decoding is not verifying

Anyone can read a JWT, because it is not encrypted. Its security comes from the signature, which only a server holding the key can validate. That is why this tool never asks for a secret or private key, and why you should never trust a payload without verifying the signature on the back end.

Frequently asked questions

Is it safe to paste my token here?

Decoding happens locally in JavaScript and nothing is transmitted. Still, treat production tokens as credentials and avoid sharing them.

Why isn't the signature validated?

Validation requires the secret key (HMAC) or the public key (RSA/ECDSA). This tool focuses on inspection without handling keys.

What is the difference between JWT and JWE?

A signed JWT (JWS) has a readable payload. JWE encrypts the content and has five segments; it cannot be read without the decryption key.

Related tools