JWT Decoder

Decode a JWT's header and payload without verifying signature server-side.

Overview

Decodes and inspects JSON Web Token (JWT) headers and claims payloads client-side, displaying algorithm headers, expiration timestamps, and user scopes.

Formula & Calculation Method

Decoded_Payload = JSON.parse(Base64URL_Decode(JWT.split('.')[1]))

A JWT consists of three parts separated by dots: Header, Payload, and Signature. Decoding parses Header and Payload without verifying cryptographic signature.

Worked Example: Inspecting an Authentication Bearer Token

Inputs: JWT Token: eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0NTYiLCJ1c2VyIjoibWFuaSIsImV4cCI6MTgwMDAwMDAwMH0.signature

  • Split token by dot delimiters into three segments.
  • Base64URL decode Segment 0 (Header: alg = 'HS256', typ = 'JWT').
  • Base64URL decode Segment 1 (Payload: sub = '123456', user = 'mani', exp = 1800000000).
  • Convert unix timestamp exp into formatted human expiration date.

Summary: Header: HS256 | Subject: 123456 | User: mani | Expiration Validated

Common Use Cases

  • OAuth & Auth0 Debugging: Inspect user permissions, roles, and expiration claims during API integration.
  • Token Expiry Checking: Check the 'exp' claim to verify whether an access token has expired.
  • Client-Side State Inspection: Audit user profile attributes passed in identity tokens (ID tokens).

Frequently Asked Questions

Is decoding a JWT safe on Calciverse?

Yes, decoding runs 100% locally in your browser memory; your authentication tokens are never sent to external servers.

Why is decoding not the same as verifying a JWT?

Anyone can edit a token's payload and re-encode it; verification requires the cryptographic secret key or public certificate to confirm the signature.

What are common standard JWT claims?

sub (subject/user ID), iss (issuer), aud (audience), exp (expiration time), and iat (issued at time).

Related Calculators & Tools