Developer tools
JWT Decoder

JWT decoder

Paste a JSON Web Token to see its header, claims and expiry at a glance. Decoding happens on your device, so you can inspect real tokens without pasting them into a website that might log them.

Open JWT Decoder — free Get the Windows app

Free in your browser — no sign-up. Install from the Microsoft Store to use it offline on Windows 10 and 11.

How to use it

Open the JWT Toolkit and paste a token, or open a .jwt file.
Read the decoded header and payload. Standard claims — iss, sub, aud, iat, nbf, exp, jti — are labelled.
Check the badge to see whether the token is still valid, or how long ago it expired.

Example

Token

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.
eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkFkYSBMb3ZlbGFjZSIsImlhdCI6MTcwMDAwMDAwMCwiZXhwIjoxNzAwMDAzNjAwfQ.
2N-E3ZkgLmbRuDkcgAcX11F5sDbSHVcTxvQjr7ilJt0

Decoded

// Header
{
  "alg": "HS256",
  "typ": "JWT"
}

// Payload
{
  "sub": "1234567890",
  "name": "Ada Lovelace",
  "iat": 1700000000,  // 2023-11-14 22:13 UTC
  "exp": 1700003600   // 2023-11-14 23:13 UTC
}

// Badge: Expired

Features

Private by design — tokens are decoded locally and never sent over the network.
Readable claims — registered claims are labelled, and expiry is shown as a relative time.
Expiry check — see instantly whether a token is valid or expired.
Verify signatures — HS256 with a shared secret, RS256 and ES256 with a public key. PRO
Sign test tokens from a header and payload, and generate RSA or EC key pairs. PRO

Frequently asked questions

Is it safe to paste a production JWT here?

Decoding runs entirely on your device and the token is not transmitted. Still, treat tokens like passwords: a JWT payload is only Base64URL-encoded, not encrypted, so anyone holding the token can read it.

Does decoding a JWT verify it?

No. Decoding only reads the header and payload. To know a token is genuine you must verify its signature with the secret or public key — CodeForge Pro does this for HS256, RS256 and ES256.

What does the exp claim mean?

exp is the expiry time as a Unix timestamp in seconds. CodeForge converts it to a readable date and tells you whether it has passed.

Does the JWT decoder work offline?

Yes. Install CodeForge from the Microsoft Store and it works without an internet connection.

One workspace for all of it

JWT Decoder is one of 18 developer tools in CodeForge — alongside a JSON formatter, JWT decoder, regex tester, UUID and hash generators, and more. Press Ctrl+K to jump to any of them.