Ideambox
All tools
TOOL IDB-SWE-017
JWT decoder

Desktop only

Engineering tools are available only on desktop screens.

JWT decoder

Paste a JWT. Get decoded header + payload, algorithm, expiry, and standard claims. All client-side — token never leaves your browser.

Token anatomy & expiry header.payload.signature
structure HEADER alg / typ PAYLOAD claims SIGNATURE HMAC / RSA VALIDITY WINDOW now iat — exp — —
Engineering notes

JWT format

  • Three Base64URL-encoded parts joined by dots: header.payload.signature.
  • Header: alg (HS256, RS256, ES256, none, …) and typ.
  • Standard claims: iss, sub, aud, exp, nbf, iat, jti.

Security

  • Never trust an alg:"none" token. Always verify signature on the server.
  • JWT payloads are not encrypted — anything in there is readable.

Result

Live
Header


Payload