Skip to main content
NeatUtility

JWT Decoder

Security & HashingMemory Only100% Client-Side
Ready
JWT
0 lines0 chars
0 B / 976.6 KB
About this tool, examples & FAQ

Decode a signed JWT's header and payload and inspect its claims locally in browser memory. Decoding does not verify the signature — the output always reports signature.verified: false — and a token without exp reports status Not specified rather than valid.

Key facts

Verified capabilities and limits of this utility
Accepted inputSigned JWT text with 3 dot-separated segments; 5-segment encrypted (JWE) tokens are rejected
Decoded outputHeader, payload, optional claims summary, and an explicit unverified-signature note
Max input size1 MB
Execution deadline2 s
Processing locationSensitive: decoded in browser memory; pasted tokens are not uploaded for processing

How to use

  1. Paste your encoded JWT into the token input editor.
  2. Click 'Run' to decode.
  3. Inspect the decoded JSON output with header parameters, payload claims, and the claims summary.
  4. Check the diagnostics bar for expiration (Expired vs Active) or not-before validity.
  5. Toggle 'Include Claims Summary' to show or hide the extracted standard claims, and set JSON indentation.

Example

Decode a synthetic token without expiry

Input

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0IiwibmFtZSI6IkFkYSJ9.ZmFrZS1zaWduYXR1cmU

Example output

{
  "header": {
    "alg": "HS256",
    "typ": "JWT"
  },
  "payload": {
    "sub": "1234",
    "name": "Ada"
  },
  "summary": {
    "algorithm": "HS256",
    "type": "JWT",
    "status": "Not specified",
    "issuedAt": "Not specified",
    "expiresAt": "Not specified",
    "lifespan": "Not specified",
    "subject": "1234",
    "issuer": "Not specified",
    "audience": "Not specified"
  },
  "signature": {
    "verified": false,
    "note": "Decoded locally in browser memory. The cryptographic signature has NOT been verified against a secret or public key."
  }
}

Edge cases

Missing exp is unspecified

A token without an exp claim reports status Not specified — that means no expiry information, not a token that is valid forever.

Expired and not-before tokens

Expired tokens raise a TOKEN_EXPIRED warning and tokens used before nbf raise TOKEN_NOT_YET_VALID; both are evaluated against the run clock.

Unsecured tokens

Tokens with alg missing or 'none' raise an UNSECURED_TOKEN warning because they carry no signature to check.

Encrypted and malformed tokens

Five-segment encrypted (JWE) tokens and inputs with other segment counts are rejected with an invalid-input error.

Registered claim semantics

Standard claims carry agreed meanings: iss identifies the issuer, sub the subject, aud the intended audience as a string or array, exp/nbf/iat are NumericDate seconds for expiry, not-before, and issued-at, and jti is a unique token ID shown in the payload when present. The summary echoes these values without interpreting custom claims.

Surrounding whitespace

Leading and trailing whitespace around the token is trimmed before decoding.

How it works

  1. Trims surrounding whitespace and requires exactly 3 dot-separated segments.
  2. Rejects 5-segment encrypted (JWE) tokens that need a decryption key.
  3. Decodes the protected header and payload without checking the signature.
  4. Evaluates exp, iat, and nbf claims against the run clock for status and warnings.
  5. Renders header, payload, optional summary, and the unverified-signature note as indented JSON inside a Web Worker bounded by the tool deadline.

Related workflows

Frequently asked questions

Does decoding verify the signature?

No. Decoding only parses the Base64URL header and payload. The output always carries signature.verified: false because verification against a secret or public key never happens here.

Can anyone read a signed JWT payload?

Yes. Typical signed JWT payloads are only encoded, not encrypted, so anyone holding the token can decode and read the claims. Never put secrets in a signed payload.

What is the difference between expiry and signature validity?

Expiry (exp) and not-before (nbf) describe the token lifetime against a clock; the signature describes authenticity against a key. This tool reports lifetime from claims but never establishes authenticity.

What if a token has no exp claim?

The summary reports status Not specified. Missing expiry is unspecified lifetime information — not proof the token stays valid.

Is it safe to paste a real token here?

Decoding runs in browser memory inside a Web Worker and pasted tokens are not uploaded for processing, but treat real tokens as secrets anyway: anyone holding one can read its payload, and copying, downloading, or handing output to another tool moves the data through those explicit actions.

Can encrypted (JWE) tokens be inspected?

No. Five-segment encrypted tokens keep their payload confidential without the decryption key, so they are rejected with an explanatory error.

References