Skip to content
ForgePlug — Logo
Developer100% Browser-Based

JWT Decoder

A premium JWT Decoder that works entirely in your browser. Paste any JWT token to instantly decode its header, payload, and signature. View standard claims like issuer, subject, audience, and expiration with a live countdown timer. Supports all JWT algorithms and custom claims. Features beautifully formatted JSON panels, copy and export options, and example tokens — all without sending your token to any server. No cryptographic verification is performed; this is a decoder, not a signature verifier.

Your Token is Safe

JWT Decoder works entirely in your browser. Your token is never uploadedto any server. All decoding happens locally using JavaScript's built-in Base64 decoder.

Paste a JWT token to decode

Paste → Decode → Inspect

Keyboard Shortcuts

Decode JWTCtrl+Enter
ClearCtrl+L

Example Tokens

Pre-built JWT examples to explore. Each example demonstrates different JWT features.

HS256 Token

Standard JWT signed with HMAC-SHA256

HS256

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxM...

RS256 Token

JWT signed with RSA-SHA256, showing public key claims

RS256

eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImtleS...

Expired Token

JWT that has already expired — demonstrates expiry detection

HS256

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJle...

Expiring Soon

JWT expiring within hours — demonstrates expiring-soon detection

HS512

eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJzZ...

Custom Claims

JWT with custom namespaced claims and permissions

ES256

eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImVjLW...

No Expiration

JWT without an exp claim — demonstrates unknown expiration

HS256

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJub...

Important: This is a Decoder, Not a Verifier

This tool only decodes the Base64-encoded segments of a JWT. It does not verify the cryptographic signature. Anyone can decode a JWT — the security comes from signature verification, which requires the secret key or public key. Never trust a JWT based solely on its decoded content.

Frequently Asked Questions

What is a JWT?
A JSON Web Token (JWT) is a compact, URL-safe token format used for transmitting claims between two parties. It consists of three Base64-encoded segments separated by dots: a header (containing the algorithm and token type), a payload (containing the claims), and a signature (used to verify the token's integrity). JWTs are commonly used for authentication and authorization in web applications and APIs.
How do JWTs work?
When a user logs in, the server creates a JWT containing user claims and signs it with a secret key (HMAC) or a private key (RSA/ECDSA). The client stores this token and sends it in the Authorization header with each request. The server can then verify the signature and extract the user's identity from the payload without needing a database lookup. This makes JWTs ideal for stateless authentication in REST APIs and distributed systems.
Is decoding a JWT secure?
Yes, decoding a JWT is completely safe. A JWT's header and payload are only Base64-encoded, not encrypted — anyone possessing the token can read them. The security of a JWT comes from the signature, which requires the secret key to verify. Our tool only decodes the header and payload so you can inspect their contents. We do NOT verify signatures, which means we cannot validate if a token has been tampered with.
Can ForgePlug verify JWT signatures?
No. ForgePlug's JWT Decoder is a decoding and inspection tool only — it does NOT verify signatures. Signature verification requires access to the signing secret (for HMAC algorithms) or the public key (for RSA/ECDSA algorithms), which we do not ask for. To verify a JWT's authenticity, you need to check the signature on your server or use a dedicated JWT library. Think of this tool as a way to inspect what's inside a token, not to prove it's legitimate.
Is my JWT token uploaded to a server?
Absolutely not. Everything happens entirely in your browser. The JWT is decoded using JavaScript's built-in atob() function combined with the TextDecoder API. Your token never leaves your device — no network requests, no uploads, no server processing. The security notice at the top of the page reinforces this commitment. This is a core privacy feature of all ForgePlug tools.
What information can I see in a JWT?
Our decoder extracts and displays the following: the header (algorithm, token type, key ID), the payload (all standard claims like issuer 'iss', subject 'sub', audience 'aud', expiration 'exp', issued-at 'iat', and any custom claims), and the raw signature. We also show the expiration status with a countdown timer, the token's structure breakdown, and a beautified JSON view of both the header and payload segments.
What does the expiration status mean?
We show three statuses: 'Valid' (green) — the token is not expired and has more than 7 days remaining; 'Expiring Soon' (amber) — the token expires within 7 days; 'Expired' (red) — the token has already passed its expiration time. For tokens without an exp claim, we show 'No Expiration' (gray). The countdown timer updates in real-time so you can see exactly how much time is left.
4.8 · Trusted by Developers

Frequently Asked Questions

Everything you need to know about decoding JWT tokens

What is a JWT?
A JSON Web Token (JWT) is a compact, URL-safe token format used for transmitting claims between two parties. It consists of three Base64-encoded segments separated by dots: a header (containing the algorithm and token type), a payload (containing the claims), and a signature (used to verify the token's integrity). JWTs are commonly used for authentication and authorization in web applications and APIs.
How do JWTs work?
When a user logs in, the server creates a JWT containing user claims and signs it with a secret key (HMAC) or a private key (RSA/ECDSA). The client stores this token and sends it in the Authorization header with each request. The server can then verify the signature and extract the user's identity from the payload without needing a database lookup. This makes JWTs ideal for stateless authentication in REST APIs and distributed systems.
Is decoding a JWT secure?
Yes, decoding a JWT is completely safe. A JWT's header and payload are only Base64-encoded, not encrypted — anyone possessing the token can read them. The security of a JWT comes from the signature, which requires the secret key to verify. Our tool only decodes the header and payload so you can inspect their contents. We do NOT verify signatures, which means we cannot validate if a token has been tampered with.
Can ForgePlug verify JWT signatures?
No. ForgePlug's JWT Decoder is a decoding and inspection tool only — it does NOT verify signatures. Signature verification requires access to the signing secret (for HMAC algorithms) or the public key (for RSA/ECDSA algorithms), which we do not ask for. To verify a JWT's authenticity, you need to check the signature on your server or use a dedicated JWT library. Think of this tool as a way to inspect what's inside a token, not to prove it's legitimate.
Is my JWT token uploaded to a server?
Absolutely not. Everything happens entirely in your browser. The JWT is decoded using JavaScript's built-in atob() function combined with the TextDecoder API. Your token never leaves your device — no network requests, no uploads, no server processing. The security notice at the top of the page reinforces this commitment. This is a core privacy feature of all ForgePlug tools.
What information can I see in a JWT?
Our decoder extracts and displays the following: the header (algorithm, token type, key ID), the payload (all standard claims like issuer 'iss', subject 'sub', audience 'aud', expiration 'exp', issued-at 'iat', and any custom claims), and the raw signature. We also show the expiration status with a countdown timer, the token's structure breakdown, and a beautified JSON view of both the header and payload segments.
What does the expiration status mean?
We show three statuses: 'Valid' (green) — the token is not expired and has more than 7 days remaining; 'Expiring Soon' (amber) — the token expires within 7 days; 'Expired' (red) — the token has already passed its expiration time. For tokens without an exp claim, we show 'No Expiration' (gray). The countdown timer updates in real-time so you can see exactly how much time is left.

Share this tool

Share
Runs in your browser100% privateNo data uploaded