MundoKit

JWT Decoder

Paste a compact JWT to inspect its header, payload and registered claims. Decoding runs locally and does not verify a signature.

Everything runs locally in your browser. Enable JavaScript to use the tool.

How it works

Split the compact token at its dots, decode unpadded base64url as UTF-8 and parse the header and payload as JSON. RFC 7519 defines NumericDate claims in seconds since the Unix epoch. Expiration is exclusive: a token is expired when the current time reaches exp. Relative seconds round up before expiration and down after expiration. Date displays truncate milliseconds toward zero; submillisecond claims are labeled approximate with the parsed NumericDate retained alongside them. Finite NumericDates outside the date-display range still receive expiration comparisons.

This is a decoder only. It does not verify signatures, trust an issuer, enforce an audience or authorize access. Encrypted tokens are outside its scope. Tokens are never uploaded or saved in a share link. The input limit is 256 KiB.

Worked examples

Expiration at the epoch

An exp claim of 0 is 1970-01-01T00:00:00.000Z. At epoch second 60 the display says “Expired 60 seconds ago”.

Not before one minute

An nbf claim of 60 is 1970-01-01T00:01:00.000Z. At epoch second 0 it is not active yet.

Frequently asked questions

Is decoding verification?
No. Anyone can construct a readable payload. Use a trusted verifier and application claim checks before accepting it.
What do iss, sub and aud mean?
They identify the issuer, subject and intended audience. Their expected values belong to your application.
What are iat and jti?
iat is the issued-at NumericDate. jti is a token identifier. Neither alone proves authenticity.
What does alg none mean?
It identifies an unsecured token with no cryptographic protection. HS uses a shared secret; RS uses RSA keys. This page verifies neither.

Sources

Last reviewed 2026-11-14. The method is written out above so you can check our math.