JWT Decoder
Decode a JWT header and payload, check the standard claims and see expiry status - locally, without sending the token anywhere.
Result
{
"alg": "HS256",
"typ": "JWT"
}{
"sub": "1234567890",
"name": "Netvorx Example",
"iat": 1785103200,
"exp": 1785106800,
"role": "engineer"
}Claims
| Claim | Meaning | Value |
|---|---|---|
| sub | Subject | 1234567890 |
| name | custom claim | Netvorx Example |
| iat | Issued at | 1785103200 (2026-07-26 22:00:00 UTC) |
| exp | Expires at | 1785106800 (2026-07-26 23:00:00 UTC) |
| role | custom claim | engineer |
About JWT Decoder
A JWT is three base64url segments: header, payload and signature. The first two are readable by anyone holding the token - so a JWT is authenticated, not confidential. This decodes both locally and flags the claims that commonly cause problems.
Revocation, and why it is hard
A signed token is valid until it expires because verification is local — that is the whole point, and it is also the problem. Logging a user out, disabling an account or changing a role has no effect on tokens already issued. The practical pattern is short-lived access tokens (minutes) paired with a refresh token checked against server state, plus a version or session claim that can invalidate a family of tokens. Anything longer than an hour without a revocation story is a security decision, not an implementation detail.
What decoding does and does not prove
Decoding shows what the token claims. Only signature verification with the correct key proves the claims are authentic. The classic vulnerability is a server that decodes and trusts without verifying, or one that accepts alg: none, or one that lets the token choose between HMAC and RSA verification - the algorithm confusion attack.
Common use cases
- Checking whether a 401 is caused by an expired token.
- Inspecting which scopes or roles an identity provider issued.
- Debugging clock skew between an issuer and a validator.
Edge cases and gotchas
- Never paste a production token into an online decoder you do not control. This one runs locally, but the habit is dangerous.
- JWT payloads are not encrypted - do not put anything sensitive in them.