Is it safe to paste production JWT tokens into this decoder?

Yes, 100%. Decoding and signature verification are executed exclusively inside your browser's local sandbox using native JavaScript and the Web Cryptography API. No tokens, secrets, claims, or header values are ever sent to an external server, proxy, or logged to disk.

What are the three parts of a JSON Web Token?

A standard JWT consists of three base64url-encoded segments separated by periods (.): 1) Header (specifying the signing algorithm like HS256 or RS256 and token type), 2) Payload (containing standard claims like 'exp', 'iat', 'sub', and application data), and 3) Signature (used to verify that the token was not tampered with in transit).

How does the live expiration countdown work?

The tool parses the standard 'exp' (expiration time) numeric Unix timestamp from the payload claims, multiplies it by 1000 to convert to milliseconds, and compares it against your current system time. It displays an active countdown or expired indicator alongside exact UTC and local timestamps.

Can I verify token signatures client-side?

Yes. For HMAC-SHA256 (HS256) signed tokens, you can input your shared secret into the signature section. The tool uses the browser's crypto.subtle API to compute the HMAC hash across the header and payload and verifies whether it matches the token's signature segment.

What is the difference between HS256 and RS256 tokens?

HS256 uses a symmetric shared secret known to both the token issuer and verifier. RS256 (and ES256) uses asymmetric public/private key cryptography, where the token is signed using a private key and verified using a public certificate or JWKS (JSON Web Key Set).

Why does my token show 'Invalid JWT structure'?

A valid compact JSON Web Token must have exactly three segments separated by dots. If your token has fewer or more than two periods, contains whitespace, or includes bearer prefixes like 'Bearer ', remove the prefix and ensure the token format is Header.Payload.Signature.

JWT Decoder & Token Inspector

Decode and inspect JSON Web Tokens (JWT) client-side. Inspect header algorithms, payload claims, expiration countdowns, and verify HMAC signatures securely in your browser.

Live

JWT
JSON
Text

JWT Decoder & Token Inspector

Decode, inspect, and verify JSON Web Tokens (JWT) client-side in your browser. Parse header algorithms, payload claims, expiration timestamps, and verify HMAC signatures without transmitting sensitive tokens or secrets over the network.

Encoded JWT String

Verify Signature (HMAC / Symmetric)

🔒 Verification executes 100% locally in your browser using W3C Web Cryptography API. Secrets are never transmitted.

Ready to Inspect Your Token

Paste a JWT in the input box on the left, or click below to load an interactive pre-signed demo token.

100% In-Browser Privacy: Your JSON Web Tokens and verification keys never touch a server or backend database. All Base64URL decoding, expiration evaluation, and WebCrypto HMAC verification are executed strictly in your local browser sandbox.

What is a JSON Web Token (JWT)?

A JSON Web Token (JWT) is an open, industry-standard format (defined in RFC 7519) for securely transmitting information between parties as a compact, self-contained JSON object. Because JWTs are digitally signed using a symmetric shared secret (e.g., HMAC-SHA256) or an asymmetric public/private key pair (e.g., RSA or ECDSA), their authenticity and integrity can be reliably verified by any receiving service.

1. Header

Contains metadata about the token, typically the signing algorithm (alg, such as HS256 or RS256) and the token format (typ: "JWT"). It is Base64URL-encoded into the first dot segment.

2. Payload (Claims)

Contains the statements about an entity (typically the user) and additional metadata. It houses standard claims (like expirationexp, subject sub) along with custom application attributes like roles and permissions.

3. Signature

Calculated by taking the encoded header, the encoded payload, a secret key, and running them through the designated cryptographic algorithm. This guarantees that the message was not modified in transit.

How to Use the JWT Decoder?

Inspecting JWTs with Elixuvo is designed to be frictionless, informative, and totally secure:

1.
Paste or Load Your TokenPaste your compact JWT string into the left input area. If you accidentally copied Bearer from an Authorization header, the tool flags it and offers a one-click clean button.
2.
Inspect Segment Color CodingNotice the three-part visualization matching industry standards: Header (Rose/Red), Payload (Purple/Indigo), and Signature (Blue/Sky).
3.
Review Timestamp & Expiration StatusThe status banner instantly flags whether your token is Active, Expired, or Not Yet Valid, displaying exact UTC and Local human-readable times.
4.
Verify or Export Decoded ClaimsIf using HMAC-SHA256, type your secret into the verification box to confirm authenticity. Click "Copy Decoded JSON" or "Download .json" to save claims locally.

Common JWT Claims (RFC 7519 Reference)

The IANA JSON Web Token Registry standardizes registered claim names to provide a cohesive, interoperable vocabulary across authentication providers and APIs.

Claim	Full Name	Data Type	RFC 7519 Description
iss	Issuer	String (URL/URN)	Identifies the principal or authority that issued the JWT (e.g. https://auth.company.com).
sub	Subject	String	Identifies the entity (user ID or account) the token represents and asserts permissions for.
aud	Audience	String / Array	Identifies the intended recipients or resource servers for which the JWT is designated.
exp	Expiration Time	NumericDate (Unix)	Timestamp on or after which the JWT must NOT be accepted for processing.
nbf	Not Before	NumericDate (Unix)	Timestamp before which the JWT must NOT be accepted for processing.
iat	Issued At	NumericDate (Unix)	Timestamp at which the JWT was originally created and signed.
jti	JWT ID	String (UUID)	A unique identifier for the token, primarily used to prevent replay attacks.

Frequently Asked Questions (FAQ)

No, never. All parsing, decoding, Base64URL string manipulation, and cryptographic HMAC verification occur 100% client-side inside your browser sandbox using native JavaScript and the W3C Web Cryptography API (crypto.subtle). Your sensitive tokens and secret keys never travel across the internet.

Yes! A standard JWT is signed, not encrypted. The header and payload are simply Base64URL-encoded strings that anyone can decode back into plaintext JSON. Never store confidential passwords, private keys, credit card numbers, or unencrypted personally identifiable information (PII) inside a JWT payload unless you are using JWE (JSON Web Encryption).

Next Steps with this file

Continue directly into another tool without saving and re-uploading

1-Click Transfer • No re-upload required

text

Featured

JSON Formatter, Validator & Minifier

Format, validate, minify, and inspect JSON payloads with real-time syntax checking, custom indentation, and key sorting. 100% private in-browser tool.

Base64 Encoder & Decoder

Encode and decode text, JSON, and files to and from Base64. Supports UTF-8 Unicode, URL-safe Base64, and image Data URIs with zero network transfer.

UUID v4 & Password Generator

Generate cryptographically secure bulk UUID v4 identifiers and high-entropy random passwords client-side using the Web Cryptography API.

Code to PDF Converter

Convert source code files (Python, JS/TS, C++, Rust, Go, Java, SQL, HTML, CSS, JSON) into syntax-highlighted PDF documents with line numbers and custom themes in your browser.

Code · PDF

Open

Claim

Full Name

Data Type

RFC 7519 Description

iss

Issuer

String (URL/URN)

Identifies the principal or authority that issued the JWT (e.g. https://auth.company.com).

sub

Subject

String

Identifies the entity (user ID or account) the token represents and asserts permissions for.

aud

Audience

String / Array

Identifies the intended recipients or resource servers for which the JWT is designated.

exp

Expiration Time

NumericDate (Unix)

Timestamp on or after which the JWT must NOT be accepted for processing.

nbf

Not Before

NumericDate (Unix)

Timestamp before which the JWT must NOT be accepted for processing.

iat

Issued At

NumericDate (Unix)

Timestamp at which the JWT was originally created and signed.

jti

JWT ID

String (UUID)

A unique identifier for the token, primarily used to prevent replay attacks.

File Downloaded Successfully!

JWT Decoder & Token Inspector

JWT Decoder & Token Inspector

Ready to Inspect Your Token

What is a JSON Web Token (JWT)?

1. Header

2. Payload (Claims)

3. Signature

How to Use the JWT Decoder?

Common JWT Claims (RFC 7519 Reference)

Frequently Asked Questions (FAQ)

Next Steps with this file

Related tools

JSON Formatter, Validator & Minifier

Base64 Encoder & Decoder

UUID v4 & Password Generator

Code to PDF Converter

JWT Decoder & Token Inspector

Ready to Inspect Your Token

What is a JSON Web Token (JWT)?

1. Header

2. Payload (Claims)

3. Signature

How to Use the JWT Decoder?

Common JWT Claims (RFC 7519 Reference)

Frequently Asked Questions (FAQ)

Next Steps with this file