Skip to main content
Castov
DEVELOPER

JWT Decoder

Decode and inspect JSON Web Tokens (JWT) instantly in your browser. Inspect header and payload claims, review human-readable expiration dates, and check token validity status. Decoded 100% locally with zero server requests.

Decoded locally. Signature is NOT verified. Do not paste production secrets.

All token decoding takes place strictly inside your browser sandbox via JavaScript. No token is ever transmitted to any server.

Token Lifetime Status Token Active & Valid
iat (Issued At)
Tue, 14 Nov 2023 22:13:20 GMT
1064d ago (1700000000)
nbf (Not Before)Not specified
exp (Expires At)
Fri, 15 Jan 2027 08:00:00 GMT
in 93d (1800000000)
Decoded Header
{
  "alg": "HS256",
  "typ": "JWT"
}
Decoded Payload
{
  "sub": "user_123456",
  "name": "Alex Dev",
  "email": "alex@example.com",
  "role": "admin",
  "iat": 1700000000,
  "exp": 1800000000,
  "iss": "castov.io"
}
Signature Hash
SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

Client-Side JWT Parsing and Token Inspection

JSON Web Tokens (RFC 7519) are the industry standard for stateless authentication and authorization between modern web applications and microservices.

Debugging authorization headers and token payloads requires viewing the encoded claims without exposing sensitive user tokens to remote third-party servers. Castov decodes tokens purely in browser memory.

Automated Timestamp and Lifetime Verification

JWT timestamps like exp, iat, and nbf are stored as raw Unix epoch seconds. Our decoder automatically converts these numeric timestamps into human-readable UTC dates and displays relative validity badges.

This lets you instantly determine whether a token expired 5 minutes ago or remains valid for upcoming requests.

Want the background? Read our comprehensive guide: JSON Web Tokens (JWT) Security Best Practices.

How to use this tool

  1. Paste your encoded JWT (header.payload.signature) into the token input box.
  2. Inspect the decoded Header and Payload JSON structures in the side-by-side viewer.
  3. Review token lifetime claims including iat (Issued At), nbf (Not Before), and exp (Expires At).
  4. Copy the formatted JSON payload or header with the copy button.

Examples

JWT token structure and standard claims inspection.

Decoded Claims

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiZXhwIjoxODAwMDAwMDAwfQ...

Algorithm (alg)
HS256
Subject (sub)
1234567890
Expires (exp)
Epoch timestamp verified locally

Frequently Asked Questions

Is it safe to paste JWT tokens into this decoder?
Yes. All decoding occurs 100% locally in your browser memory. However, as noted in the banner, never paste production secrets into untrusted environments.
Does this tool verify the JWT signature?
No. This tool decodes and parses the header and payload claims only. It does not verify the cryptographic signature against a public or secret key.
What does the token validity status indicator mean?
It checks the standard exp (Expiration Time) and nbf (Not Before) claims against your current device time to indicate if the token is currently active, expired, or not yet valid.
What are standard JWT claims?
Standard claims defined in RFC 7519 include iss (Issuer), sub (Subject), aud (Audience), exp (Expiration Time), nbf (Not Before), and iat (Issued At).
Why is a JWT composed of three parts separated by dots?
A standard JWT consists of Header.Payload.Signature. The Header specifies the algorithm and token type, the Payload contains the claims, and the Signature validates message integrity.

Related tools