JWT Decoder

Decode JWT header and payload locally; never treats a decoded token as verified.

DEVELOPER & CODE · LOCAL WORKBENCH · BROWSER WORKSPACE

Read the claims. Treat every decoded value as untrusted.

Decode JWT header and payload locally; never treats a decoded token as verified.

01 · TOKEN INPUTDECODE LOCALLY

Paste a JSON Web Token

Decoded in this browser

The token is not uploaded. Avoid pasting real production tokens into shared or public devices; decoded claims may contain personal information.

Decode is not verification.

This tool does not validate the signature, issuer, audience, expiry policy, or permissions. A displayed claim is untrusted input and must never authorize a request.

02 · TOKEN INSPECTIONEXPIRED

ALGORITHM CLAIMHS256

EXPIRY STATUSExpired

EXPIRY TIME2026-08-06 08:06:40 UTC · 72d ago

ESTIMATED LIFETIME1.0 h

No basic warning was triggered. This still does not mean the signature or claims are valid.

03 · PAYLOAD CLAIMS7 CLAIMS

sub1234567890

Subject · usually the user or account this token describes.

nameAda Lovelace

Readable display name · anyone holding the token can decode it.

iat1786000000 → 2026-08-06 07:06:40 UTC · 72d ago

Issued at · Unix time in seconds.

exp1786003600 → 2026-08-06 08:06:40 UTC · 72d ago

Expiry · Unix time in seconds. The server should refuse the token after this time.

isshttps://auth.example.com

Issuer · identify who made the token and verify it server-side.

audapi.example.com

Audience · the service this token is for; the server should check it.

roleadmin

04 · THREE TOKEN SEGMENTSSIGNATURE SEGMENT PRESENT

HEADER

{
  "alg": "HS256",
  "typ": "JWT"
}

PAYLOAD

{
  "sub": "1234567890",
  "name": "Ada Lovelace",
  "iat": 1786000000,
  "exp": 1786003600,
  "iss": "https://auth.example.com",
  "aud": "api.example.com",
  "role": "admin"
}

SIGNATUREdummy-signature-not-verified

◎

Runs in this browser. The token is decoded in this browser. Decoding does not verify its signature, issuer, audience, expiry, or permissions; never use these results to authorize access.

Back to the tool library ↗

Need a feature from the original version? Open the current ECECH tool

How this app works

Decode JWT header and payload locally; never treats a decoded token as verified. Processing is local; output is not a security certification.