JWT Decoder and Encoder

Decode a JWT and check expiry, then verify its signature or encode a test token - both run in your browser.

JWT Token
Verify signature Not checked yet

Signing and verification run in this browser. Keys and secrets are never sent to ComUtil.

Header 
{
  "alg": "HS256",
  "typ": "JWT"
}
Payload 
{
  "iss": "https://issuer.example.com",
  "aud": "api://comutil",
  "sub": "user-123",
  "iat": 1700000000,
  "nbf": 1700000000,
  "exp": 4102444800
}
Warnings
No warnings detected
Claim Summary
Issuer https://issuer.example.com
Audience api://comutil
Subject user-123
Issued At (iat) 2023-11-14 22:13:20 UTC
Not Before (nbf) 2023-11-14 22:13:20 UTC
Expires (exp) 2100-01-01 00:00:00 UTC
Token Information
Algorithm HS256
Type JWT
Status VALID
Token Segments
Header Length: 36 
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9
Payload Length: 168 
eyJpc3MiOiJodHRwczovL2lzc3Vlci5leGFtcGxlLmNvbSIsImF1ZCI6ImFwaTovL2NvbXV0aWwiLCJzdWIiOiJ1c2VyLTEyMyIsImlhdCI6MTcwMDAwMDAwMCwibmJmIjoxNzAwMDAwMDAwLCJleHAiOjQxMDI0NDQ4MDB9
Signature Length: 9 
signature
Auth/API workflow guide

Working through a bearer-token failure? Use the guide for claim triage, then return here to inspect the live token.

Read the JWT guide Open the Auth/API hub
Base64 Encode / Decode Tool
Jump into raw Base64URL segment inspection or credential payload encode/decode.
Base64 Basic Auth guide
Follow the shared auth-header path.
JSON API response guide
Move into payload inspection next.
Unix Timestamp
Verify exp, iat, or nbf with a timestamp-to-date conversion before you rotate a token.
URL encoding guide
Trace the OAuth flow into redirect parameters.
Example Presets
Valid session Expired token
Privacy and Sharing
Server processing JWT decoding sends the token to ComUtil so the server can parse claims, warnings, and share-safe outputs.
Sensitive input A decoded token is still a live credential. Use an expired or test token when you only need to inspect the claim structure.
What is a JWT?

JSON Web Token (JWT) is an open standard (RFC 7519) for securely transmitting information between parties as a JSON object. JWTs can be signed using a secret (HMAC) or a public/private key pair (RSA/ECDSA). They're commonly used for authentication and information exchange in web applications.

JWT Structure

A JWT consists of three parts separated by dots: Header (algorithm and token type), Payload (claims/data), and Signature (verification). Each part is Base64Url encoded. The signature ensures the token hasn't been tampered with, but the header and payload can be decoded by anyone.

Common Use Cases
  • User authentication and authorization
  • Single Sign-On (SSO) systems
  • API authentication
  • Secure information exchange between services
  • Stateless session management
Standard Claims
iss Issuer - Who created and signed the token
sub Subject - Who the token is about (usually user ID)
aud Audience - Intended recipient of the token
exp Expiration - Unix timestamp when token expires
iat Issued At - Unix timestamp when token was created
Frequently Asked Questions

Are JWTs encrypted?

Standard JWTs (JWS) are signed but not encrypted - anyone can read the payload. For encrypted tokens, use JWE (JSON Web Encryption). Never store sensitive data in regular JWTs.

How do I invalidate a JWT?

JWTs are stateless by design and can't be directly invalidated. Common strategies include short expiration times, token blacklists, or changing the signing key (invalidates all tokens).