JWT Decoder
Inspect JSON Web Token claims.
Runs entirely in your browser. Nothing you enter or upload leaves your device.
What the JWT decoder does
A JSON Web Token (JWT) is a compact string, made of three parts joined by dots, that apps use to carry sign-in sessions and API permissions. The first two parts are just Base64URL-encoded JSON, so anyone holding the token can read them. This decoder turns them back into formatted JSON and explains the standard claims in plain words.
Developers reach for it when an API suddenly returns 401, when a login works on one server but not another, or when they need to confirm which user, audience or scopes a token was issued for. It’s also handy for learning what an identity provider actually puts in its tokens.
How to use the JWT decoder
- Paste the token. A leading “Bearer ” is removed for you.
- The header and payload appear as formatted JSON, and the claims table turns exp, iat and nbf into readable dates.
- The status line tells you if the token has expired, isn’t valid yet, or uses the “none” algorithm.
Understanding the results
The status line names the signing algorithm from the header, such as HS256 or RS256, then says when the token expires or how long ago it expired. In the claims table, common claims get a label: iss is the issuer, sub the subject (usually a user ID), aud the audience the token is meant for, and jti a unique token ID. Times appear in your local time, in ISO format and as a relative time such as “in 45 min”. These are worked out from your device clock, so a clock that’s set wrong will skew the expiry status.
The third part, the signature, is shown as it is. It proves the token was issued by someone holding the right key and hasn’t been changed since, but checking it needs that key, so this tool doesn’t try. A token that decodes cleanly can still be forged or edited. When an API rejects a token that looks fine here, the usual suspects are a signature checked with the wrong key, an aud or iss the server doesn’t expect, or clocks that disagree about exp and nbf.
Questions
Does this verify the signature?
No. This tool decodes only. A token that decodes can still be forged or altered. Always verify the signature on your server with the correct key before trusting any claim.
Is it safe to paste a real token?
The token is decoded in your browser and not sent to UtiBox. Still, treat live tokens like passwords and avoid pasting them into tools you do not trust.
Why can’t it read my token?
Encrypted tokens (JWE, five parts) cannot be read without the key. Other tokens fail if a part is not valid Base64URL JSON.
What does the “none” algorithm warning mean?
The header says the token has no signature, so nothing stops anyone from changing its claims. Servers should reject such tokens unless you’ve deliberately allowed them.