Private developer tools
JWT Decoder & Inspector
Decode a JSON Web Token, inspect colored header and payload JSON, understand standard claims, and spot expiration or unsafe algorithms.
Private token inspector
Paste a JSON Web Token
This decoder does not verify signatures. It does not possess the signing key and cannot prove that a token is authentic or safe to trust.
{
"alg": "HS256",
"typ": "JWT"
}{
"sub": "1234567890",
"name": "Ada Lovelace",
"admin": true,
"iss": "toolpacker.com",
"iat": 1700000000,
"exp": 1893456000
}demo-signatureRead the token
Header, payload, and claims
The decoder separates the token, formats its JSON, and translates numeric time claims into readable local dates.
Security boundary
Decoding is not verification
A readable payload proves nothing about who created it. Verify signatures, algorithms, issuer, audience, and required claims in the application that accepts the token.
How to use it
Get a reliable result
- Paste a three-part compact JWT.
- Review the decoded header, payload, and interpreted time claims.
- Use the result only for inspection; verify the signature and claims in the system that trusts the token.
Useful for
Common workflows
- Debug an unexpected issuer or audience claim
- Check whether an exp timestamp is in the past
- Inspect an algorithm header during development
Examples
What to expect
- Input
- A payload containing exp: 1893456000
- Output
- The numeric date displayed as a readable UTC timestamp
Know before you start
Important limitations
- The inspector does not verify signatures, keys, issuers, audiences, revocation, or authorization.
- Encrypted JWEs and detached or non-compact token formats are not decoded.
- Avoid pasting live credentials into any tool when a safer test token is available.
Common questions
JWT Decoder FAQ
Does this verify a JWT signature?
No. It only decodes the token. Signature verification requires the correct secret or public key and expected algorithm, issuer, and audience.
Is my token uploaded?
No. The JWT is decoded entirely in your browser and is never uploaded or stored.
Can I trust a decoded token?
Not from decoding alone. Anyone can create or modify Base64URL content. Trust a JWT only after your application verifies its signature and required claims.
Which claims are explained?
The inspector highlights issuer, subject, audience, issued-at, expiration, and not-before claims when present.
Processed on your device
JWT content and decoded claims stay in this browser and are never uploaded.
How this processing works
The tool reads and processes this input in your browser. Tool Packer's application server does not receive the input or generated result.
Read the full privacy explanation