token.jwt — 1 tool ● LIVE
JWT Decoder
SIGNATURE SHOWN · NEVER VERIFIED · NO SECRET ASKED
Token · raw 0 CHARS
NETWORK PAYLOAD: 0 BYTES · PROCESSING: LOCAL
Decoded · live — IDLE
UPDATES ON EVERY KEYSTROKE
Segments0/3HEADER · PAYLOAD · SIG
Algorithm—FROM THE HEADER
Issued—IAT CLAIM
Expires—EXP CLAIM

Developer Tools · Group 08 of 19

JWT Decoder.

Paste a token once and watch it come apart along its two dots — header, payload and signature painted in three colors as you type. Claims decode live: exp, nbf and iat get real dates and verdicts, the algorithm is read straight from the header, and alg:none tokens get a red flag instead of a pass. The signature is displayed but never verified — this bench never asks for your secret and never sends the token anywhere. Nothing is uploaded, nothing is stored.

  • Tools01
  • Segments03
  • Decodinglive
  • Backendnone
  • Costfree
The one tool, in detail

What the decoder reads — and what it refuses to.

( 01 )

A JSON Web Token is three base64url segments joined by dots, and this bench treats each one according to what it is. The header is decoded as JSON and its algorithm is lifted into the verdict strip — with a red flag for alg: none, the classic unsigned-token trick. The payload is decoded as JSON and its claims get a second, human column: exp and nbf are compared against your machine's clock and stamped VALID, EXPIRED or NOT YET VALID; iat gets a real date and a "how long ago"; iss, sub, aud and jti are named, and unknown claims pass through untouched. The signature is displayed in full — and deliberately never verified, because verification needs the secret or public key, and a page that never asks for your secret is the only kind you should paste tokens into. Everything re-decodes on every keystroke, so a token being typed or edited stays live from the first character.

Example

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJrZWVwZXItMDEiLCJzaXRlIjoiQ2FsbG93YXkgUmlkZ2UiLCJpYXQiOjE3NTEzMjgwMDAsImV4cCI6MTgxNDQwMDAwMH0.k7Qx0J3m…

header { alg: HS256, typ: JWT } payload { sub: keeper-01, site: Calloway Ridge, iat: Tue, 01 Jul 2025 · 13 months ago, exp: Thu, 01 Jul 2027 · VALID in 11 months } signature shown in full — structure checked, secret never asked

Use it for auth-flow debugginginspecting ID tokensAPI troubleshootinglearning JWTs

Anatomy · the same token, three jobs
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJrZWVwZXItMDEiLCJzaXRlIjoiQ2FsbG93YXkgUmlkZ2UiLCJpYXQiOjE3NTEzMjgwMDAsImV4cCI6MTgxNDQwMDAwMH0.k7Qx0J3mVtRz8wYpLq2Ns5HdGfBcXaEiOu1ZvT4jMnW
Header

Base64url(JSON). Names the signing algorithm and token type — the first thing the decoder reads, because everything downstream depends on it.

Payload

Base64url(JSON). The claims — who the token is for, who issued it, when it was minted and when it dies. Encoded, never encrypted: anyone holding the token can read it.

Signature

The HMAC or RSA result over the first two segments. Proof of integrity and origin, not secrecy — and the one part this bench will display but never verify, since that would require your secret.

Decoding rules · a JWT is exactly three base64url segments joined by two dots — anything else is reported, never guessed · base64url means + → -, / → _, padding dropped — the decoder restores all of it before unpacking · header and payload are decoded as UTF-8 JSON; a segment that decodes but isn't JSON is flagged, not faked · exp, nbf and iat are read as Unix seconds and compared against your machine's clock · alg: none gets a red flag, not a pass · unknown claims pass through untouched, in their original order · the signature is displayed but never verified — verification needs the secret or public key, which this bench never asks for · the token you paste never leaves this tab

The privacy promise

Paste any token. We couldn't read it even if we wanted to.

This page has no backend and no database. Every segment split, every claim dated and every verdict stamped just now was computed by JavaScript inside your own browser tab — your token never traveled a single centimeter of cable. Close the page and it's gone for good. And one honest reminder, since we're decoding credentials: a JWT's payload is encoded, not encrypted — treat tokens like keys, here and everywhere.

✕ SERVER · DATABASE · LOGS · ANALYTICS
  • Databasenull
  • Backendnone
  • Token uploads0
  • Secrets asked0
Questions

Asked often, answered plainly.

( 02 )
Is my token's signature verified here?

No — and that's deliberate. Verifying an HS256 signature requires the shared secret; RS256 and friends need the public key. This bench decodes structure only: it splits the token, reads the header and payload, dates the time claims and displays the signature untouched. It never asks for a secret, and you should never paste a production secret into any web page — including ours.

Is it safe to paste my JWT here?

The token never leaves your browser tab — there is no backend, no request, no storage. But remember what a JWT is: the header and payload are merely base64url-encoded, not encrypted, so anyone who holds the token can read them, and anyone who holds a valid signature can use it. Treat tokens as credentials — paste test tokens freely, and be careful with live production ones anywhere, including here.

Why does it say EXPIRED when the token looks fine?

Because the exp claim carries a Unix timestamp that has already passed, compared against your machine's clock. The token is still perfectly readable — decoding and validity are different questions. A real API will reject it with a 401, and the red verdict here tells you that before you spend an hour debugging something else entirely.

What's the difference between encoding and encryption?

Base64url encoding is a transport format with zero secrecy — anyone can reverse it, which is exactly why this decoder exists. A standard JWT (JWS) is signed, not encrypted: the signature proves integrity and origin, while the payload stays readable to anyone holding the token. If the payload itself must stay secret, that's JWE — JSON Web Encryption — a different format with five segments instead of three.

Is my data saved anywhere?

No. IrisTool has no backend and no database. Decoding happens inside your browser tab and the token disappears the moment you close or refresh the page. There is nothing to leak, because nothing is ever collected.