JWT Decoder
Decode the header and claims of a compact JWS JWT locally in your browser. No signature verification is performed.
This tool handles input and primary processing in your browser and is designed not to send the input to QuickKit’s server.
Avoid live production secrets; use dummy or masked data where possible. Data handling details
- Signature bytes
- Unsecured (alg: none)
Header
Payload
How it works
This tool only decodes a three-part compact JWS JWT: header.payload.signature, each part Base64URL-encoded (RFC 7515). It shows the header and the payload as JSON and the signature only as its length in bytes. It does not verify its signature, issuer, audience, expiry, or authenticity. Pasted JWTs stay in this browser and are never sent to a server.
Reading the header: alg names the algorithm that protects the token. HS256 is HMAC using SHA-256, RS256 is RSASSA-PKCS1-v1_5 using SHA-256, and ES256 is ECDSA using P-256 and SHA-256 (RFC 7518 §3.1). typ is often JWT, and kid, when present, tells the receiver which key to use. alg: none marks an Unsecured JWT, which has an empty signature (RFC 7519 §6); the result flags it.
Reading the payload: the registered claims are iss (issuer), sub (subject), aud (audience), exp (expiration time), nbf (not before), iat (issued at), and jti (JWT ID) (RFC 7519 §4.1); any other names are agreed between issuer and receiver. exp, nbf, and iat are NumericDate values: seconds since 1970-01-01T00:00:00Z UTC, ignoring leap seconds (RFC 7519 §2). For example, "iat": 1735689600 with "exp": 1735693200 means issued at 2025-01-01T00:00:00Z and expiring one hour later, at 01:00:00Z. A receiver must not accept the token at or after exp, or before nbf, and may allow a few minutes of clock skew (RFC 7519 §4.1.4, §4.1.5). This tool does not convert them to dates. It shows the header and payload re-serialized after JavaScript's JSON.parse, so an integer beyond ±(2^53 − 1), such as a 64-bit ID, may appear rounded, and a number written as 1.0 or 1e3 appears as 1 or 1000; NumericDate values for realistic dates are well within that range. To convert them and compare them with a chosen time, use JWT Time Claims.
What "not verified" means: decoding needs no key, and anyone can build a token with any header and payload, so the decoded contents are only what the token claims. The receiver decides whether to trust it by validating the signature with the expected key and algorithm (RFC 7515 §5.2) and then checking claims such as exp, nbf, iss, and aud. Do not base an access decision on what this tool shows. The payload of a JWS is encoded, not encrypted: anyone who holds the token can read it.
Not supported: JWE (five parts), the JWS JSON serialization, and an unencoded payload (b64: false, RFC 7797). Tokens are limited to 16,384 characters.