# JWT Decoder

URL: https://phishdestroy.io/developer-tools/jwt-decoder
Category: General dev
Where it runs: Runs locally (nothing you enter is uploaded)

Decode the header and payload of a JSON Web Token and see its algorithm and expiry time. Decoding is not verification: anyone can create a token with any claims, and this tool does not check the signature.

## Example input

Expired HS256 token

```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkV4YW1wbGUgVXNlciIsImlzcyI6Imh0dHBzOi8vbG9naW4uZXhhbXBsZS5jb20iLCJpYXQiOjE3MzU2ODk2MDAsImV4cCI6MTc2NzIyNTYwMH0.fZc5SMMXQnIXN_Wp4LbRAVAIBkvKWiZcYxDJ2NzpkaA
```

The header shows alg HS256 and typ JWT, the payload shows sub, name, iss, iat and exp, and Status reads EXPIRED because exp (2026-01-01 00:00:00 UTC) has passed.

## FAQ

### Does it verify the token's signature?

No. It only Base64url-decodes the header and payload and ignores the signature, so a forged or altered token decodes the same way. The status line says whether exp has passed and always notes that the signature was not verified.

### Which tokens can it read?

Signed JWTs with three dot-separated parts. Encrypted tokens (JWE, five parts) are rejected, nbf and iat are shown but not checked, and a part that is not valid JSON is displayed as raw text.

### Is the token sent anywhere?

No. Decoding runs in your browser and nothing is uploaded. A live token can still grant access to an account, so do not paste production tokens into tools you do not trust, and revoke any token you think was phished.

## Related tools

- [JWT Generator (HS256)](https://phishdestroy.io/developer-tools/jwt-generator)
- [Base64 Encoder / Decoder](https://phishdestroy.io/developer-tools/base64-encoder-decoder)
- [HMAC Generator](https://phishdestroy.io/developer-tools/hmac-generator)
- [Unix Timestamp Converter](https://phishdestroy.io/developer-tools/unix-timestamp-converter)
- [JSON Formatter](https://phishdestroy.io/developer-tools/json-formatter)
- [Cookie & Set-Cookie Parser](https://phishdestroy.io/developer-tools/cookie-parser)

All tools: https://phishdestroy.io/developer-tools