UFOZoo

JWT Decoder — Decode, Verify & Debug JSON Web Tokens

Decode JSON Web Tokens instantly — view header, payload, and signature. Inspect claims with human-readable timestamps. Detects expired and weak tokens.

Features

  • ✓Decode JWT header, payload, and signature instantly
  • ✓Inspect registered claims with human-readable timestamps
  • ✓Security warnings — expired tokens, missing exp, alg: none
  • ✓Pretty-printed JSON for header and payload
  • ✓Signature shown in hex bytes
  • ✓All processing runs locally — tokens never leave your device
  • ✓Claims summary table — all registered claims displayed with descriptions and current validity status
  • ✓Base64URL decoded preview for each segment before JSON parsing
  • ✓Supports all JWT formats including JWE and nested JWTs
  • ✓Copy header, payload, or signature individually with one click

How to Use

  1. 1Paste your JWT token (header.payload.signature) into the input area. Parsing happens automatically.
  2. 2Review the decoded header and payload JSON, claims summary, and signature bytes.
  3. 3Check warnings for security issues like expired tokens or weak algorithms.
  4. 4Examine the claims summary table to see each registered claim's value and whether the token is currently valid, expired, or not yet active.
  5. 5Copy individual segments (header, payload, or signature) using the copy buttons next to each section.
  6. 6Use the pretty-printed JSON view to inspect the full structure of the header and payload.
  7. 7Check the signature hex bytes to verify the token format — valid signatures have the expected length based on the algorithm.
  8. 8Test with sample tokens from your development environment to validate your JWT implementation.

Frequently Asked Questions

What is a JWT?

∨
A JSON Web Token (JWT) is a compact, URL-safe way to represent claims between two parties. It consists of three Base64URL-encoded parts separated by dots: header (algorithm & token type), payload (claims/data), and signature (cryptographic verification). JWTs are commonly used for API authentication (OAuth 2.0, OpenID Connect).

Is it safe to paste my JWT into this tool?

∨
Yes. All parsing happens entirely in your browser using JavaScript. Your token is never sent to any server, never logged, and never stored. You can verify this by checking your browser's Network tab — zero data is transmitted.

Does decoding a JWT mean it's authentic?

∨
No. Decoding a JWT only reads its contents — the header and payload are Base64URL-encoded, not encrypted. Anyone can decode a JWT. To verify authenticity, you must check the signature using the issuer's secret or public key. This tool helps you inspect the contents, but signature verification should be done server-side.

What do exp, iat, and nbf mean?

∨
exp (expiration): the token expires after this timestamp. iat (issued at): when the token was issued. nbf (not before): the token is not valid before this timestamp. This tool converts these Unix timestamps to human-readable dates and warns if the token is expired or not yet valid.

What does alg: none mean?

∨
alg: "none" means the JWT has no signature — the third part is empty. This is a security risk because anyone can forge a token with arbitrary claims. Always reject tokens with alg: none in production.

How do I verify a JWT signature?

∨
This tool decodes and displays JWT contents but does NOT verify signatures. To verify a JWT, you need: (1) the token's header (alg, kid), (2) the payload claims, (3) the token's signature, and (4) the issuer's public key (for RS/ES algorithms) or secret (for HS algorithms). Use your backend library: jsonwebtoken (Node.js), PyJWT (Python), or your framework's built-in JWT middleware. Never trust decoded JWTs without signature verification.

How do I decode a JWT without the secret?

∨
JWT header and payload are Base64URL-encoded, not encrypted. You can decode them without the secret — just paste the token and view the decoded JSON. However, decoding does NOT verify authenticity. Only the signature verification (which requires the secret or public key) confirms the token was issued by a trusted source.

What is the difference between JWT, JWS, and JWE?

∨
JWT (JSON Web Token) is the umbrella standard. JWS (JSON Web Signature) is a signed JWT — the most common type, with a cryptographic signature in the third segment. JWE (JSON Web Encryption) is an encrypted JWT where the payload is encrypted. This parser primarily handles JWS tokens but can decode JWE headers. Most JWTs you encounter in OAuth 2.0 and OpenID Connect are JWS tokens.

What is the 'kid' field in the header?

∨
kid (Key ID) is an optional header parameter that hints which key was used to sign the token. It is used when the issuer rotates keys or has multiple signing keys. Your verification library uses the kid to look up the correct public key from a JWKS (JSON Web Key Set) endpoint. Without a matching kid, the issuer may reject your verification attempt.

Can I use this tool to debug OAuth 2.0 / OpenID Connect tokens?

∨
Yes. This tool is excellent for inspecting ID tokens and access tokens from OAuth 2.0 / OpenID Connect providers like Google, Auth0, Keycloak, and Azure AD. Decode them to verify claims like iss (issuer), aud (audience), sub (subject), email, and expiration times during development and debugging.

What does 'iat' and 'nbf' mean for token validity?

∨
iat (Issued At): when the token was created. This is informational — the token is valid from this time. nbf (Not Before): the token should not be accepted before this time. Together with exp (Expiration), these define the token's valid time window. A properly configured server checks: current_time >= nbf AND current_time < exp. This tool shows human-readable dates and warns if the token is outside its validity window.

Related Tools

Base64 Encoder/Decoder — Encode & Decode Text Online

Encode text to Base64 or decode Base64 to readable text. Supports UTF-8, emojis, and non-Latin scripts. Drag-and-drop file upload. 100% browser-based.

JSON Formatter — Beautify, Validate & Minify JSON Online

Format, minify, pretty-print, and syntax-highlight JSON data. Features key sorting, custom indentation, tree view, error highlighting, and file upload.

Hash Calculator — MD5, SHA-256 & 25+ Algorithms Online

Calculate hashes using 25 algorithms including MD5, SHA-256, SHA3, BLAKE3, and more. Supports HMAC, hash verification, and uppercase/lowercase output.