ToolXkit Icon

JWT Decoder

Read the header and payload of a JSON Web Token.

  • Free
  • No signup
  • Nothing uploaded
  • No watermark

The key stays on your device. Nothing is sent anywhere.

Header

{
  "alg": "HS256",
  "typ": "JWT"
}

Payload

{
  "sub": "1234567890",
  "name": "John Doe",
  "iat": 1516239022
}

Header fields

algAlgorithm — how the signature was made
HS256
typType — almost always JWT
JWT

Payload claims

subSubject — who the token is about, usually a user id
1234567890
name
John Doe
iatIssued at — when the token was created
15162390222018-01-18 01:30:22 UTC

How to Use the JWT Decoder Online

JWT Decoder: before and after TEXT A YOUR INPUT JWT DECODER DONE A RESULT

JWT Decoder splits a JSON Web Token at its two dots and shows the header and the payload as readable JSON. If the payload carries an exp claim, the expiry is shown as a date and marked Expired or Valid; the issued-at time is shown too. It decodes; it does not verify the signature, because that needs the secret, and pasting a signing secret into a web page is exactly the wrong move.

A JSON Web Token is three base64 segments separated by dots: a header, a payload of claims, and a signature. This splits and decodes the first two so you can read who the token is for and when it expires. It does not verify the signature — that needs the secret, and pasting a signing secret into a web page is exactly what you should not do.

No software to install Free Works on any device

Step-by-Step Guide to Using the JWT Decoder

  1. 1. Paste or type your input

  2. 2. Adjust the options to suit

  3. 3. Copy or download the result — it updates as you type

Try it now

What is the JWT Decoder?

A JSON Web Token is three base64 segments separated by dots: a header, a payload of claims, and a signature. This splits and decodes the first two so you can read who the token is for and when it expires. It does not verify the signature — that needs the secret, and pasting a signing secret into a web page is exactly what you should not do.

At a glance

  • Takes: A token in the form header.payload.signature
  • Gives: Header and payload as formatted JSON, plus expiry and issued-at as local dates
  • Status: Expired or Valid, judged from the exp claim against the current time
  • Does not: Verify the signature or check the issuer; that belongs on your server
  • Runs: Decoding happens in the tab; the token is not sent anywhere
  • Price: Free, no login

Why Use Text Tools Online?

Counting words, changing case, pulling emails out of a page or writing an amount in words are small jobs that eat time by hand. These tools do them the moment you paste, and the text stays in your browser.

“Paste once, and let the tool do the fiddly part.”
  • Counts as you type
  • Lists sorted and cleaned
  • QR codes for anything
  • Cheque amounts in words
  • Case changed in one click
  • Emails and links pulled out
  • Citations in APA or Chicago
  • Handy commands for developers

Popular Uses for Text Utilities

Short, repetitive text jobs are what these tools were made for.

  • Essay word limits Check that an essay or application answer is within the word or character limit.
  • Fixing capital letters Turn text typed in CAPS LOCK into normal sentence case without retyping it.
  • Collecting contacts Pull every email address or phone number out of a long message or page.
  • Writing cheques Get a rupee or dollar amount written correctly in words for a cheque or invoice.
  • QR codes Make a QR code for a website link, contact card, email address or event.
  • Reference lists Format a book or website reference in APA or Chicago style for an assignment.
  • Tidying lists Sort lines alphabetically, remove repeats or add numbers to a pasted list.
  • Command helpers Build a cron schedule, git command or chmod setting without searching the manual.

What You Can Do with the JWT Decoder

Handles the padding and character-set rules the specification requires

Explains why the input failed, not just that it did

Tests against the actual specification rather than a simplified pattern that rejects valid input

Why Use ToolXkit for JWT Decoder?

Your files stay with you

Everything runs inside your browser. Nothing you open or type is uploaded to a server.

Writing and Text Tools for Different Users

Students

Count words, format citations and tidy notes before submitting coursework.

Writers and bloggers

Change case, find repeated words and check length before publishing a piece.

Office workers

Clean up pasted lists, find and replace names and write amounts in words.

Marketers

Extract emails, links and hashtags from pages and make QR codes for campaigns.

Developers

Encode Base64, build cron lines and generate git and shell commands quickly.

Accountants

Write invoice and cheque amounts in words and tidy columns of pasted figures.

Best Times to Clean Up Text

Text tools save time when you are:

  • Keeping to a word limit
  • Fixing text typed in capitals
  • Building a contact list from emails
  • Writing out a cheque
  • Printing a QR code poster
  • Finishing a reference list
  • Removing repeats from a list
  • Setting up a scheduled job

Tips and Good to Know

  1. A token that decodes is not a token that is genuine. Anyone can mint a payload with any claims; only the signature check proves it, and that is not done here.

  2. Encrypted tokens (JWE) will not decode, because the payload is ciphertext rather than base64 JSON.

  3. Paste tokens from test or development environments. A live session token is a credential, and this page cannot stop you pasting it somewhere else afterwards.

Frequently Asked Questions

Answers to common questions about this tool.

Does this verify the token is genuine?

No, and deliberately not. Verifying a signature needs the signing secret, and pasting a signing secret into a web page is exactly what you should never do. This decodes the header and payload so you can read the claims — treat anything you see as unverified until your server checks it.

Is it safe to paste a real token here?

Nothing is transmitted — the decoding happens in the page on your own machine. That said, a live token is a credential, so the ordinary caution applies: on a shared or public computer, use an expired one.

Is my text sent anywhere when I use JWT Decoder?

No. The text you paste is handled in your browser and never leaves the page. That makes it safe for drafts, customer lists and anything else you would rather keep to yourself.

Is there a limit on how much text I can paste?

The site sets none. Long documents are handled by your own device, so a whole book may be slow on an older phone. Articles, essays and long lists are no trouble.

Can I use JWT Decoder without making an account?

Yes. There is no login, no email to hand over and no daily limit. Open the page, paste or type, and copy or download the result when it is ready.

Why does my word count differ from Microsoft Word?

Programs treat hyphenated words, numbers and symbols a little differently. The gap is usually a few words in a long piece. If a teacher or portal sets a limit, stay a little under it to be safe.

Do the QR codes made here expire?

No. The information is stored directly in the pattern, with no redirect through our servers, so the code keeps working for as long as the link or text inside it stays valid.

Further reading

  • Unicode Consortium The body that sets how letters, symbols and emoji from every language are stored as text.
  • Letter case (Wikipedia) The rules and names for upper case, lower case, title case and the styles programmers use.
  • Base64 (MDN) A plain explanation of Base64, the encoding used to carry files and images as text.

More Text & Developer Tools

Other free tools for the same kind of job.

Browse all tools